I have set up a transitive forest trust between my Windows 2003 forest and another Windows 2003 forest. Both sides of the trust appear to be set up correctly in the AD Domains & Trusts. However, when I try to add a user from the other forest to a security group in my forest, I am not given the trusted forest as an option. Can anyone help? thanks, Paul

Paul, the issue is most likely due to the fact that you are not following the membership rules for groups. For example, if you access the properties of a global group, you are not going to see the trusted forest as an option since global groups can only contain members from the same domain. Visit anITKB.com, an IT Knowledge Base. Follow me on Facebook.

Your right...it is a "group" thing. Only domain local security groups will display the other forest\domain and allow me to add a user from the other forest\domain. However, global and universal security groups do not even display the trusted domain, and just typing in the domain\username won't work either. Is this the way it should work? thanks for your help

I am not following your last two sentences... Can you provide more details as to what you are exactly trying to do? Are you trying to add/modify group membership? Or are you trying to add permissions to an NTFS resource? Domain A/B? Visit anITKB.com, an IT Knowledge Base. Follow me on Facebook.

hello, I am trying to add/modify group membership. I am trying to add a user from domain B to a universal security group in domain A. thanks, Paul

Hello, see here about the Group scopes and how to handle it: http://technet.microsoft.com/en-us/library/cc755692(WS.10).aspxBest regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.