A common administrative task that has always required Administrator rights is setting up a one-way trust from a resource domain to an account domain. This setup lets you keep user accounts in a central location (i.e., the trusted domain) while granting the accounts access to resources in the trusting domain. Windows Server 2003 has a new group called Incoming Forest Trust Builders. Members of this group can create incoming one-way trusts to the local forest without having built-in administrative rights. Because this feature delegates the incoming trust process, it can be useful if your organization wants to off-load the task of trust creation to another group.