How to enable/disable filtering for SIDHistory management?

When you establish a trust relationship between two Active Directory domains, SIDHistory management is disabled by default: this is SID filtering.

In this case, migrated users cannot access the data of their old domain, even if the SIDHistory values have been correctly migrated to the target domain.

You can enable or disable filtering with the NETDOM command. In the commands below, replace SOURCE_DOMAIN, DESTINATION_DOMAIN and TRUSTED_DOMAIN with the names of your domains.

Important: the option to use depends on the type of trust: /Quarantine:Yes|No for a domain trust, /EnableSIDHistory:Yes|No for a forest trust.

Disable filtering (enable SIDHistory management)

Domain trust

From the source domain:

NETDOM TRUST SOURCE_DOMAIN /Domain:TRUSTED_DOMAIN /Quarantine:No

From the destination domain:

NETDOM TRUST DESTINATION_DOMAIN /Domain:TRUSTED_DOMAIN /Quarantine:No

Forest trust

From the source domain:

NETDOM TRUST SOURCE_DOMAIN /Domain:TRUSTED_DOMAIN /EnableSIDHistory:Yes

From the destination domain:

NETDOM TRUST DESTINATION_DOMAIN /Domain:TRUSTED_DOMAIN /EnableSIDHistory:Yes

Enable filtering (disable SIDHistory management)

Domain trust

From the source domain:

NETDOM TRUST SOURCE_DOMAIN /Domain:TRUSTED_DOMAIN /Quarantine:Yes

From the destination domain:

NETDOM TRUST DESTINATION_DOMAIN /Domain:TRUSTED_DOMAIN /Quarantine:Yes

Forest trust

From the source domain:

NETDOM TRUST SOURCE_DOMAIN /Domain:TRUSTED_DOMAIN /EnableSIDHistory:No

From the destination domain:

NETDOM TRUST DESTINATION_DOMAIN /Domain:TRUSTED_DOMAIN /EnableSIDHistory:No