Trusts and Forests Considerations for Team Foundation Server

This post details the considerations for trusts and forests when deploying Team Foundation Server (TFS) across different Active Directory domains and forests. It outlines the supported Active Directory modes and functional levels, and the trust relationships required between various TFS components (clients, application-tier server, proxy server, data-tier server, build) to ensure proper authentication and authorization. It emphasizes that the domain of the Team Foundation application-tier server must trust the domain of the user and the TFSService account, and similarly for other components. It also notes that the Team Foundation Server Proxy computer's domain must trust the user's domain, and the application-tier server's domain must trust the proxy's service account domain. For the data-tier server, its domain must trust the TFSService account's domain, the TFSReport account's domain, and the application-tier server's domain. For Team Foundation Build, its domain must trust the service account's domain. The post also highlights that all other Active Directory domain configurations are unsupported and that appropriate cross-forest trusts are necessary when supporting work across multiple forests. It recommends installing TFS in a Windows Server 2003 domain environment for security considerations and suggests banning duplicate names and securing computer names by creator to avoid impersonation attacks.