I have setup a new domain (called "b") which trusts our old domain (called "a"). This is a one way trust which allows users from "a" to login and authenticate to domain "b" with their domain "a" credentials. The problem we are encountering is that we are unable to add "a" groups and users to domain "b"s groups. In AD when trying to add groups/users under locations only domain "b" is listed. However, if we create a shared folder on a computer in domain "b" we can add groups and users from domain "a" without any issues and those users are able to access without any troubles.

Domain "a" contains two server 2003 domain controllers and one windows 2000. Domain "b" contains one server 2008 domain controller and one server 2008 RODC.

Forest functional level of domain "a" is 2000, while forest functional level of "b" is 2008.

How can we add groups/users from domain "a" to groups in domain "b"? Is what we are trying do even possible given current infrastructure/configuration?

Thank you in advance for any help.


You are probably trying to use a group that does not have the proper scope to see the members from the trusted domain.

If this is a cross forest trust the only type of group you will be able to use to assign users from domain b permissions in domain 'a' is a Domain local.

If this is not a cross forest trust then you can use Domain Local or Universal.

Microsoft has a good Technet Article about group scope.

  • Thanks for the recommendation. I tried adding a domin local group from domain "a" to a group in domain "b" and when I hit apply a warning message appears that states: "Logon failure: unknown user name or bad password." I am not able to add the group at this point. Also, under the members tab domain "a" is not listed as a location option, I thought it would given domain "b" trusts domain "a" but not vise versa.
    – IT Team
    Nov 4 '09 at 21:22
  • The domain 'b' group would need to be the domain local group type. the domain 'a' group would have to be either Global or Universal. As far as the permission denied, I think that is just the failure message that it pops up when you are trying to do something out of scope for that group
    – Zypher
    Nov 4 '09 at 22:50
  • We actually had them switched around. Once we set our domain "b" group to local and our domain "a" group to universal everything worked as intended. Thank you for your help!
    – IT Team
    Nov 5 '09 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.