I would like to create a Universal Group whose members are a mix of cross-forests users and groups.

In the following example, two forests are mentioned (US and UK) and two domains in each forest (GeneralStaff and Java):

For example, the universalDevelopers group may comprise of members from UK.Java.Developers and US.Java.Developers. Then, for example, there may be a group of universalSales which contains the users UK.GeneralStaff.John and US.GeneralStaff.Dave.

In UK forest at the minute, I can freely add members and groups from the UK. But there is no way to add members from the US forest, despite having a two-way trust in place... e.g. I can login with US members into UK and vice-versa.

A further complication is that, with a Universal group in the UK (which contains three domains), I can only add two of the three. It can't see the third.

Could people please provide some thoughts on why cross-forest groups can't be created and ways of 'seeing' all domains within a forest.

EDIT: This is on a combination of Windows 2003 and 2008 server. Answers can be regarding either. Thanks!


You can't add users from a trusted forest domain to a Universal Group. You would need to use a Domain Local Group. See Active Directory Group Scope. You don't mention what you want to use the groups for, so that's as much as I can suggest for use.

  • Side question for you. It seems quite counter-intuitive that a domain local group that is specific to a singular domain, has the ability to add users from another domain or even forest. Why is this? – Federer Oct 3 '12 at 13:38
  • 2
    It's a misnomer really, the "Domain Local" portion is supposed to reference the fact that the group can only be used on resources in the local domain. – HostBits Oct 3 '12 at 13:49
  • Ah I see. I'm relatively new to Active Directory and therefore learning only when I need to. Am I right in asserting that Global and Universal groups, unlike Domain Local, do not allow access to resources but rather allow in the organisation of users in a domain? Which would explain why cross-domain/forest users would be allowed access to resources in a given domain, assuming it trusts it. – Federer Oct 3 '12 at 13:57
  • 2
    Not quite, any "scope" (domain local, universal, etc) could be used for access to resources if it is a "security" group. "security" groups get Security Identifiers, whereas a "distribution" group could not be used to give access to resources. "Distribution" groups would be used more so for creating email list serves in an email system. – HostBits Oct 3 '12 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.