Tenable researchers have identified a specific misclassification issue within Active Directory (AD) that causes certain legacy trust relationships to be flagged as insecure. The discovery centers on trusts created during the Windows 2000 era, which are incorrectly identified by modern security tools as high-risk “External” trusts. This misidentification leads to an influx of false positive security alerts, consuming valuable time and resources for IT and security teams.
The affected trusts are a specific type established for interoperability with non-Windows Kerberos V5 realms, such as MIT Kerberos. While these are technically categorized as “Realm” trusts, their underlying attributes cause them to be mistaken for a different, less secure type of trust.
The Technical Basis for Misidentification
The core of the issue lies in how Active Directory assigns attribute values to different trust types. Both the legacy Realm trusts in question and genuine External trusts share the same trustType attribute value, which is 3. Many security scanning tools and scripts query only this attribute to identify trust types. Consequently, when a tool sees the value ‘3’, it reports an External trust, which is often configured with fewer security controls.
However, the distinguishing factor is a flag within the trustAttributes property. The legacy Realm trusts have the TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10) flag set, which positively identifies them as cross-organization trusts designed for Kerberos interoperability. A genuine External trust does not have this flag. The misclassification occurs when security checks fail to evaluate the trustAttributes in conjunction with the trustType, leading to an inaccurate assessment of the trust relationship.
Security Implications of False Positives
The primary consequence of this misclassification is the generation of persistent, high-priority false positive alerts. Security teams invest effort investigating what appears to be a dangerously configured External trust, only to find it is a legacy Realm trust operating as designed. This process contributes to alert fatigue, where security personnel become desensitized to frequent, non-actionable warnings.
Furthermore, this misidentification creates confusion regarding a critical security feature known as SID filtering. SID filtering (also called quarantine) is enabled by default on External trusts to prevent privilege escalation attacks. In contrast, the misidentified Realm trusts have SID filtering disabled by default. This difference in default security posture between a genuine External trust and the misidentified Realm trust is a key source of the security alerts. Correctly identifying these trusts requires querying both the trustType and trustAttributes values to differentiate a legacy Realm trust from a true External trust.
Concise Cyber 