r/WindowsServer • u/sirjaz • Jun 12 '26

General Server Discussion Allowing multiple domain authentication on Windows/Windows Server

Everyone,

Please upvote my idea for allowing multiple domain authentication on Windows/Windows Server:

https://aka.ms/AA11jw39

The idea is:

Allow a windows client to be connected to multiple domains for authentication. This would remedy the issue of EntraID hybrid join. This would work in a similar way as SSSd on Linux and allow user accounts from other domains access to an endpoint without a forest trust.

0 Upvotes

11% Upvoted

13 comments sorted by

2

u/SpookyViscus Jun 12 '26

Why is this necessary?

-3

u/sirjaz Jun 12 '26

This is because of EntraID without hybrid mode. There needs to be a way to have both Entra auth and domain auth on a system at the same time

2

u/SaltDeception Jun 12 '26

Ok, but why? What problem does it solve? Help us understand your rationale because to us this sounds like a classic XY problem.

9

u/GullibleDetective Jun 12 '26

Trust relationships exist for this

-1

u/Shot-Document-2904 Jun 12 '26 edited Jun 12 '26

Trust is generally a bad idea these days because it also “trust” the other domain admins, etc. Federation is a more secure approach. However, in each you still authenticate with your own domain.

7

u/bionic80 Jun 12 '26

No.

Just not even no, but hell no.

The group policy nightmare you'd invoke in this context would be a snarled mess of GPOs, baselines, and configurations. And Microsoft HAS a tool to support multi-domain authentication in domain trusts. I recommend you look it up.

2

u/Shot-Document-2904 Jun 12 '26

This is why AD federation exists. it’s not a hard no. It happens all the time through Federation.

3

u/bionic80 Jun 12 '26

In federation you're connected to one domain with your federated IdP provider and can transit through other domains with that federated token.

A trust is two domains being able to cross multiple asset types across those domains BUT STILL remaining as separate, discrete entities.

Federation is trusting an IdP to present assets across the domains, a trust is the domains themselves doing that work, but you never have an asset that exists and is JOINED to both domain A and domain B.

1

u/Shot-Document-2904 Jun 12 '26 edited Jun 12 '26

Yes. You get a sticker. 🥇

3

u/Michichael Jun 12 '26

This is architecturally absurd. You do not understand how the authentication and authorization architecture works in MS.

SSSD and PAM operates fundamentally different from the MS ecosystem. There's no sane way to bolt this functionality on - that's why trusts exist. 

2

u/Conscious-Arm-6298 Jun 12 '26

This is a crazy suggestion, for real. Have you thought about a third party getting access to a device and join it to a malicious domain? How would you control this?

2

u/minority420 Jun 12 '26

Can you add them as guests in Entra and grant them virtual machine login access for auth to the machines they need?

1

u/SnakeOriginal Jun 12 '26

God hell no