Forest, external, shortcut and realm trusts; transitivity and direction; selective authentication; SID filtering

A trust is a relationship that lets users in one domain authenticate to resources in another. Trust vocabulary is directional and easy to mix up, so learn it precisely. The trusting domain holds the resources; the trusted domain holds the accounts. Access flows opposite to the trust direction: if Domain A trusts Domain B, users in B can be granted access to resources in A. A two-way trust is simply two one-way trusts. Inside a forest, every domain automatically has two-way transitive parent-child and tree-root trusts, so you only create trusts manually for other forests, other domains outside the forest, or non-Windows Kerberos realms.