how to add trusted domain users to security groups

OK, this may be one of the "dumb"er questions I have ever asked here but I am stumped - and Google just isn't getting granular enough to solve my issue.

I set up a one-way trust relationship:
Trusted domain - widget.local
Trusting domain - muppets.local
Both domains are Windows Server 2008 R2 Enterprise and have one DC each (this is a test bed).

The DC in each domain has a DNS conditional forwarder configured for the other domain.

The trust is validated and functional.

I want to create a user in widget.local that has full domain administrator (or nearly full) privileges in muppets.local.  I've found all of the articles that talk about nested groups and I have tried to do this.  But, they all say top add the foreign user but they don't say how.  So, whenever I try to add a user (or group) from widget (billybob@widget.local)  into a universal group in muppets, it just says this object cannot be found.

What am I missing?  Did I forget to configure something in the trust?  Is my syntax in adding the foreign user wrong?

This is a new realm for me.  I have never worked in trusted domains before.  Thanks for any help in advance.
crapshooterAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Sumit GuptaSystem and Virtualization EngineerCommented:
Domain admin is a global group and global group can't have member from the other domain.  You need to use AGUDLP(Accounts, Global, Universal, Domain Local, Permissions)method to add user in groups.

-Add the User Accounts to Global Groups> Global Groups to Universal Group> Universal Groups to Domain Local Groups > Domain Local Groups to the group you want to assign the permission.

Accessing resources across forests
http://technet.microsoft.com/en-us/library/cc772808%28WS.10%29.aspx 

discussion
http://social.technet.microsoft.com/Forums/en/winserverDS/thread/fa66b5c5-3ed3-4700-b479-e036577e110b
0
crapshooterAuthor Commented:
OK, but the question remains the same.  What is step-by-step behavior for this?

I created a Global group on MUPPETS.  Went into the Members tab.  Tried to add billybob@widget.local.  It replies that the object cannot be found.

Why not?
0
mcdaddy513Commented:
1.) You need to create a UNIVERSAL group on Muppets.local.
2.) Add that group to the Domain Admins for Muppets.local.
3.) Add the user(s) from Widgets.local to the new group you created.

That will grant them Domain Admins access.
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

crapshooterAuthor Commented:
How do I add the user from widgets.local to the universal group?

I try by entering billybob@widget.local and it replies that the object cannot be found.
0
mcdaddy513Commented:
You have to click on the LOCATIONS button at the Select Users window. Then choose the domain you want to add users from.
0
crapshooterAuthor Commented:
OK.  The other domain does not appear.

Any ideas why?
0
mcdaddy513Commented:
It is possible that the trust may be set up in the wrong direction. If you are wanting to add a user from the Widgets.local domain to the Muppets.local domain, you need to have a trust from Widgets.local (Trusting) to Muppets.local (Trusted).
0
crapshooterAuthor Commented:
On MUPPETS DC: Domains trusted by this domain: widget.local

On WIDGET DC: Domains that trust this domain: muppets.local

In both cases, the type is External and Transitive=No.
0
mcdaddy513Commented:
You need Widget to trust Muppets. It is backwards. In order to add a user from Muppets to Widgets, you need Widgets to trust Muppets to add the user from Muppets.
0
crapshooterAuthor Commented:
I hear what you are saying.  However, I tried it in the other direction as well:

I try by entering (on WIDGET DC) billybob@muppets.local and it replies that the object cannot be found.
0
mcdaddy513Commented:
Did you click on the LOCATIONS button? did the domain show up now?
0
crapshooterAuthor Commented:
No.  Same issue.  Only the "local" domain.
0
mcdaddy513Commented:
Have you verified that the group is a UNIVERSAL GROUP?
0
crapshooterAuthor Commented:
0
mcdaddy513Commented:
can you also send a screenshot of the trusts?
0
crapshooterAuthor Commented:
0
mcdaddy513Commented:
Ahh, my bad. You need to change the UNIVERSAL group to a DOMAIN LOCAL group. Then you should see the other domain in the LOCATIONS button.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
crapshooterAuthor Commented:
Yep!  That did it!  I can see and add users from the WIDGET domain into (Domain Local) groups in MUPPETS.

Now, it is just a matter of getting the nesting right to get the user into the Domain Admins group.
0
crapshooterAuthor Commented:
Or at least something close to Domain Admins.
0
mcdaddy513Commented:
Add that group as a member of the domain admins group.
0
crapshooterAuthor Commented:
Domain Admins is a Global Group.  It doesn't seem that you can add a Domain Local group to it.
0
mcdaddy513Commented:
Create a Universal group. Add the domain local group to that. Then add the Universal group as a member of the domain admins.
0
crapshooterAuthor Commented:
That is not working either.  However, to be fair, this is a different issue.  I am going to close this thread out and award you the points.  If I can't figure it out, I will open a new question.

Thanks for your help!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.