Domain Trusts

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Good news on getting the trust to work after changing the DNS and adding a secondary zone.

More information on DNS...

http://support.microsoft.com/kb/254680

The Universal group issue you are having...is one of the domains in Windows 2000 mixed mode..possibly the Windows2000 domain??

EDIT - you should be able to add users to universal groups in one domain then add the universal group to a domain local group in the second domain...

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

I confirm you are likely to have a domain functionality level issue here.
If any left, get rid of your NT4 domain controllers, raise the domain and forest functionality levels.


ok, sorry, I just realise I'm 2 months late...

 

you can have members of other domains in a universal group. If we have DL's on our UK domain that need US members in it, we upgrade the DL to universal and it works fine.

http://www.samspublishing.com/articles/article.asp?p=30901&seqNum=7&rl=1

If you are running a 2k DCs and a 2k3 DCs on the same domain, then you will be running in mixed mode, so in your setup, the universal groups wont work.

EDIT: in order to deal with this, you should be using a global/local combination. Create a GROUPA_L group (domain Local) on the required domain (depends on which domain the resource is on), and a GROUPA (global) group in each of the domains. you add the members to the global group in their domain, and then add all the global groups into the domain local group. you then use the local groups for applying permissions, etc.