"Dmitri Gavrilov [MSFT]" <dmitrig@online.microsoft.com> wrote in message
news:%23AYiVqAmDHA.372@TK2MSFTNGP11.phx.gbl...
Will "Forest Trust" also introduces "security risk" too. If so, why not give
them (external users) direct trusted account in the 1st AD box ?

John

Of course you can. But having an account in internal AD gives someone *a
lot* of power. I can not comment more on the topic, but there must be some
resources out there (technet that is) describing this scenario, and what is
recommended.

--
Dmitri Gavrilov
SDE, Active Directory Core

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"WJ" <JohnWebb@Yahoo.Com> wrote in message
news:eJd5ZjEsDHA.1740@TK2MSFTNGP12.phx.gbl...