Windows Server® 2012 Unleashed

User Administration in a Multidomain Forest

When multiple domains need to be supported by the same IT staff, each domain’s Domain Admins group should be added to each domain’s Administrators group. For example, domain A’s Administrators group would have Domain A Domain Admins, Domain B Domain Admins, and Domain C Domain Admins groups as members. You would need to add these domains whenever a resource or administrative task needs to grant or deny groups from each domain access to a resource in the forest.

A common best practice for larger forests is to create a universal security group named Forest Admins with each of the domain’s Domain Admin groups as members. Then you would need to configure only a single entry to allow all the administrators ...