> ## Documentation Index > Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # SharpHound Enterprise Cross-Trust Collection > Learn how to configure SharpHound Enterprise to collect data across trusted Active Directory domains and forests. Applies to BloodHound Enterprise only By default, SharpHound Enterprise collects only from the domain where the SharpHound service account belongs. If you need to collect from trusted domains or other forests, configure **Scope Collection to Multiple Domains** in the client or schedule **Advanced Options**. You can either specify a list of domains or enable **Collect from all domains trusting the SharpHound service account domain, including transitively**. ## Configure Cross-Trust Collection In **Scope Collection to Multiple Domains**, you can either specify a list of domains to collect from or enable **Collect from all domains trusting the SharpHound service account domain, including transitively**. This option also collects from trusting domains in other forests. If selective authentication is enabled on a trust, the SharpHound Enterprise service account must explicitly be granted read permissions on all AD objects in all domains of the targeted forest to perform collection. ## Collect Across External Trust Kerberos authentication works by default for all Active Directory trust types except external trusts. SharpHound Enterprise supports collection across external trusts via two mechanisms. ### Forest Search Order (preferred) Administrators can enable Kerberos authentication across external trusts by adding the name of the other domain to the [Use forest search order](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/hh920181\(v=ws.10\)) policy setting on Domain Controllers. We recommend deploying this setting to all Domain Controllers in domains with external trusts to avoid using the older and less secure NTLM authentication. ### LDAP Auto-Negotiation By default, SharpHound Enterprise only supports Kerberos authentication for the LDAP connections to Domain Controllers for Active Directory Structure Data collection. This will cause the collection across the external trust to fail without modifying SharpHound's default behavior in the `settings.json` configuration file. The default configuration file path is described in [SharpHound Enterprise Local Configuration](/install-data-collector/install-sharphound/local-configuration). To enable support for auto-negotiation in LDAP connections: 1. Stop the SharpHound Delegator service. 2. Open the `settings.json` configuration file as an Administrator (right click -> Run as Administrator on notepad.exe). 3. Change the `ForceLDAPKerberosAuth` setting to `False` (no quotes). 4. Save the `settings.json` configuration file. 5. Start the SharpHound Delegator service. If NTLM fallback is enabled, deny outbound NTLM authentication from the SharpHound server to all servers except Domain Controllers in domains with external trust relationships. For hardening guidance, see [NTLM cracking (and relaying) remediation](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening#attack-4-ntlm-cracking). ## Troubleshoot Cross-Trust Collection The collection across a trust will fail if: * The Kerberos-supported encryption types between domains/forests do not match. * Authentication has been restricted, e.g., using authentication policy silos or IPSec. * There is no network access from the SharpHound server to the trusting domain's DCs and domain-joined Windows systems in scope for privileged collection.