cross-forest access to folder

[ingram59]

I've got two forests (Forest A and Forest B ) with a validated two-way non-transitive trust between the domains in each forest. I login as a domain admin to a server in Forest B and can open AD users and computers and browse as needed. I can also open AD in Forest A from that same server in Forest B and can I see all objects.

 

Where I'm having a problem is trying to grant access to a user in the domain on Forest A to a folder on a server in the domain in Forest B.

 

On the server in the domain in Forest B, I open "Share and Storage Management and select the share to which I want to grant the user access. I right-click on the share and go to Properties / Permissions / NTFS Permissions. I click on "Add" / "Locations" and select the domain in Forest A. (See attachment) I see the icon as displayed in the attached JPG. However, when I click on the "+" sign, the domain indicated at the arrow does not open or populate.

 

This is a crucial issue that I need to resolve. What am I missing or what else do I need to do to grant the required access.

 

Thanks in advance for timely responses.

[laupopescu]

Hi,

I have been struggling with the same issue recently.

Microsoft recommends (and that's how we got it working) to have a global group in the user's forest and add the user to that group.

In the resource forest, create a Domain Local group and add the user's group to it. The group MUST BE domain local!

Try it out and let me know if it works or not.

 

P.S.: In theory, it should work also if you create a domain local group and add the user directly - however, it's not recommended.