active directory group with members from multiple domains



Using Windows 2003 active directory with multiple domains in seperate firests (using two-way trusts) is there any way I can create a group on one domain that includes users from another domain?

For example:

CENTRAL domain users:
CENTRAL\Alice
CENTRAL\Bob

BRANCH Domain Users:
BRANCH\Carol
BRANCH\dave

There is a two-way trust between BRANCH and CENTRAL, but they are not in the same forest.

Is there any way to make a group in the CENTRAL domain that includes all four users? When I tried this I found that the membership properties of the group only let me search for users in the CENTRAL domain.
DrStalkerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Glen KnightCommented:
Are you running in native 2003 mode?
If so you should be able to use a universal group to achieve this?
0
DrStalkerAuthor Commented:
I'm using windows 2003 as both the domain and forest functional level, for CENTRAL and BRANCH.  Even with a universal group there is no option in the GUI to add users from a domain other than CENTRAL, is there a special way to do this?  

0
DrStalkerAuthor Commented:
Figured it out - the group needs to be "domain local" which is somewhat counterintuitive. :-)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Glen KnightCommented:
Glad you got it sorted.
0
Mike KlineCommented:
Two acronyms you may hear with domain locals and what you are dealing with are UGLY and AGLP, I wrote about it here
http://adisfun.blogspot.com/2009/04/ugly-aglp-what-are-they.html
Thanks
Mike
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.