First of all, I'd like to point out that this question is purely theoretical. I'm asking it to better understand the nature of different groups in Active Directory.

So, I have created two separate Active Directory forests, say forest A and forest B. Moreover, I manually created a two-way transitive forest trust between them. Now, I want to try one more thing: Allow any enterprise admin in forest A to perform any administrative task in forest B.

To do so, I thought of adding the "Enterprise Admins" group of forest A to "Enterprise Admins" group of forest B. This is impossible, since the "Enterprise Admins" group can only have members within the same forest.

Next, I tried to add an intermediate group to forest B. The idea is:

"Enterprise Admins" of A ==> Intermediate group ==> "Enterprise Admins" of B

However, the only group which can host members of other forests is a "local group," which cannot be a member of any other type of groups.

So, I'm stuck here. Is it possible to achieve this task?

1 Answer 1


Unfortunately, this is impossible; the enterprise admins group can be either global or universal in scope, but in either case security principals from other forests cannot be added. The only scope which can contain security principals from other forests is the domain local scope, which can never be used outside the domain it belongs to. This includes both subgroups and users.

However, the administrators group of each domain is a domain local group, so you could add the enterprise admins group from the other forest to the administrators group of each domain. This is likely the tedious operation you were trying to avoid, but it is the easiest way to grant this permission.

For reference, check out these technet articles:

  • Thanks a lot. Just one more thing: I added the "Enterprise Admins" of forest A to the built-in "Administrators" group in a domain controller (DC1) in forest B. Now, when logged on as an enterprise admin in forest A, I can perform a variety of tasks on DC1. For instance, I can create or modify files on \\DC1\C$. However, I only have read-only access in cases were "remote management" is desired; such as when trying to remotely access DC1 using "Server Manager" or "GPMC". I don't know why this is the case. Apr 29, 2013 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .