SID Filtering is also known as Quarantine, Domain Quarantine, or SID Filtering Quarantine.
SID Filtering only applies to trusts, it cannot be enabled within a domain.
SID Filtering, by default, is not active on automatically created trusts within a forest. You can enable it, but not if the forest functional level is below Windows Server 2003. Doing so on any trust within a forest breaks replication. Additionally, if the forest functional level is Windows Server 2003 or higher; users with universal group memberships from other domains in the forest may loose access to resources if you enable SID Filtering on any of your trusts.
You can check the status of SID Filtering with the netdom.exe (Windows Domain Manager) command:
To verify the status of SID Filtering between two domains:
netdom trust <TrustingDomainName> /domain: <TrustedDomainName> /quarantine Example output: SID filtering is not enabled for this trust. All SIDs presented in an authentication request from this domain will be honored. This is the default setting between domains in the same forest.
To verify the status of SID Filtering between two forests:
netdom trust <TrustingDomainName> /domain: <TrustedDomainName> /enablesidhistory Example output: SID history is disabled for this trust. This is the default setting between trusting forests.
As you can see the two commands are nearly identical, but /quarantine applies only to domain trusts and /enablesidhistory is only valid for an outbound forest trust. They also output totally different messages making it hard to see that they actually apply to the same thing.
Thanks for sharing.