I have a cross forest trust between two Windows Server 2008 R2 domains/forests (domain and forest functional levels at Windows Server 2008 R2). Domains A and B are the forest root domains in their respective forests and domain C is the child domain of domain B.
The trust is a two-way transitive forest trust configured with forest-wide authentication. When I look at the TDO objects in each domain I see that domainB has a TDO for domainA and domainC, but domainC only has a TDO for domainB. domainA likewise has a TDO only for domainB. I see the same thing reflected in Active Directory Domains and Trusts in each domain.
When selecting the "Log on to" dropdown on a domainC computer I only see domainB and domainC listed. When selecting the "Log on to" dropdown on a domainB computer I see domainB, domainC and domainA listed. When selecting the "Log on to" dropdown on a domainA computer I only see domainA and domainB listed.
Cross forest DNS name resolution works between all three domains via conditional forwarders between domainA and domainB and I can successfully query AD SRV records in domainA from domainC and vice versa.
Am I not understanding domain transitivity in a cross forest trust? Shouldn't the transitivity extend from domainC to domainA and vice versa?
Based on Ryan's answer:
I've started to think the same thing but I have no first hand experience with a Forest Trust where a child domain exists so I don't know for sure what I should be seeing. Even though transivity should exist betweem domains A and C that doesn't neccessarily imply "visibility". I've run
nltest /dsgetdc and
nltest /dnsgetdc and all return successfully from domains A to C and vice versa. The thing that has me puzzled is that when trying to add a user to a Domain Local group in domain A I can only see domain B in Locations and not domain C. That may be the expected behavior but it seems odd. for instance, if I wanted to add a domain C user to the Remote Desktop Users Domain Local group in domain A I can't get there because I don't see domain C in locations in domain A. There's no way to "nest" a domain C user in a domain B group and then add the domain B group to the domain A group (because of group scope). So if I want to grant access to domain C users to log onto RDS servers in domain A how would I achieve that?