I have two Win2k8 forests which I do maintenance on. The two forests have full 2 way external, non transitive trust with each other.

I have a folder in forest X, domain countryX.mycompany.com accessible ONLY by the global security group named $group.

In forest Y, domain countryY.mycompany.com, countryY\user1, countryY\user2 etc needs to have access to the folder.

The natural instinct is to put user1, user2 etc into the $group. However, none of the methods for adding user to group works as it appears that the AD cannot find the groups in the other forest.

Question: 1.How to make forests see each other's security groups and be able to add? 2.In practice, what is the recommended way to achieve the user access to the folders/files in another forest?


Different group types have different "visibility" in multi-domain and multi-forest environments, as you've found (Microsoft can provide more detail). Global Groups, for example, are only "visible" within the domain in which they reside and can only contain users from that domain (because of how the security-identifiers of the member users are stored).

Microsoft's best-practice guidelines are as follows:

  • Create a global group in each domain to contain members from that domain corresponding to a job role

  • Create a domain local group in the domain with the resource to be controlled and grant the domain local group permissions to the resource

  • Nest the global groups from each domain into the domain local group

In some scenarios a universal group can come into play, too (when the resources to be managed are distributed throughout multiple domains, typically).

There some nice (albeit, w/ a funny aspect ratio) pictures in this Microsoft TechNet forum thread that can give you some background. I'd also advise looking at the Wikipedia article form some more background, as well.


Wish I could answer this question directly for you, but there is some info that you'll need to clarify for your own sake first. Read through these questions and links, and I'm sure you'll be able to get the cross-forest permissions to work.

  1. An "external trust" type can only exist between domains in 2 forests. External trusts do not connect at the forest level. Is this what you have? Link
  2. Do you have a firewall between the two forests? If so, have you confirmed that the required ports are open?
  3. Have you set up DNS forwarders between the two domains?
  4. Review this guide about security groups in Active Directory. You can only nest certain types of groups within others, and when crossing domain or forest boundaries, you are even more limited in which types of groups can be nested.

Finally, here is a great resource on TechNet: Understanding Multiple-Forest Permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.