Hi all, now I am confused but also glad i made the effort to setup a lab and test it! I have been playing with AGUDLP.

i have two forests with a two way forest trust.

I have created a domain local group and a universal group in megacorp forest. From the tailspin forest i can add a user to the domain local group (from the megacorp forest) but when i try to add a user to the universal group i cannot see / find
it!

Why can i see a domain local group from megacorp forest but cannot see a universal group from megacorp forest?

I am confused, i thought it would be the other way round?

Thanks

There is an amazing pack of free network admin tools. click here to download it

Normal since you add only users / computers / groups from the same forest as the universal group as members of this group. To add users / computers / groups from another forest, you have to use domain local groups.
See that for more details about groups' scope:
http://technet.microsoft.com/en-us/library/cc755692%28v=ws.10%29.aspx



This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

Need to support users over the internet? click here try our remote control online beta

i really do not understand tha at all!

Can someone please explain in more detail to me?

There is an amazing pack of free network admin tools. click here to download it

i really do not understand tha at all!

Can someone please explain in more detail to me?

Okay.
You have three scopes for groups:

globaluniversaldomain local
The scope of AD objects which can be members of the group is determined by these scopes.
If a group is global then you can add as members of it:

Users in the same domain as the groupGlobal groups in the same domain as the groupComputers in the same domain as the group
So, it is like the scope of this group is the domain where it is
For a universal group, you can add as members of it:

Users in the same forest as the groupGlobal groups in the same forest as the groupComputers in the same forest as the groupUniversal groups in the same forest as the group
So, it is like the scope of this group is the forest where it is
For a domain local group, you can add as members of it:

Users in the same forest and trusted forests for the groupGlobal groups in the same forest and trusted
forests for the groupComputers in the same forest and trusted forests for the groupUniversal groups in the same forest and trusted
forests for the groupDomain local groups but only from the same domain as the parent domain local group
So, it is like the scope of this group is the forest where it is and trusted forests.
For details, see the link I already provided.


This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

Need to support users over the internet? click here try our remote control online beta

thank you ver much, very misleading IMO as domain local looks as though you should only be able to add objects from the domain locally? or is that just me being silly? :)

Need to support users over the internet? click here try our remote control online beta

thank you ver much, very misleading IMO as domain local looks as though you should only be able to add objects from the domain locally? or is that just me being silly? :)
It is just a name :)


This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

There is an amazing pack of free network admin tools. click here to download it

:) thanks for your help! much appreciated! Makes sense a bit more in my lab now!

Need to support users over the internet? click here try our remote control online beta