DCSync across a trust

Cross-domain DCSync uses Active Directory replication APIs to request directory secret data from a target domain. A trust alone does not grant replication authorization: inspect the effective ACL on the target naming-context root for the required replication extended rights, including Replicating Directory Changes and Replicating Directory Changes All (the latter permits replication of secret domain data). Whether authorization data from a ticket is accepted across a trust depends on the trust boundary and effective SID-filtering configuration; do not assume an Enterprise Admin SID is accepted or grants effective rights. The ticket-based and pre-authorized target-domain credential paths are alternatives.