Windows Security Log Events by ID

Unlike Windows 2000, Windows Server 2003 only logs this event once for each new trust. Although the description says "new *trusted* domain" this event gets logged for both trusted and trusing relationships. Note trust type, trust direction, etc in descripiton.

Also accompanying this is an event ID 565 - if directory service auditing is turned on. 565 identifies the event as a "creat child", trustedDomain event and supplies the distinquished name of the new domain (e.g. CN=SouthAmerica, CN=System,DC=elm, DC=local)

Trust Directions
1 - Trusted (the domain where this event was logged accepts the identity of users of the new domain)
2 - Trusting ( (the new domain accepts the identity of users of the domain where this event was logged)
3 - 2-way (mutual trust)

Trust Type and Attributes refer to whether the trust relationship is an NT 4.0 legacy trust, Kerberos realm trust or a forest or domain trust with another active directory domain and whether the trust is transitive or not.

SID filtering involves whether SID history from the external domain is used in the local domain.
See also event IDs 610, 611 and 620