AD Parent / Child permissions confusion

Question

We have a company in Canada called company.com. We bought some companies in the USA and wanted to create children as city.us.company.com. Step one, as best we could figure, was to create a DC for us.company.com as a child of company.com. Then in each city
we created DCs as child domains newyork.us.company.com and boston.us.company.com to us.company.com.
Domain admins from company.com can administer all the children, but something isn't working as we expected. We have a group in company.com called networkshare_access and tried to add some users from newyork.us.company.com into the group. We can add users
in the child domain but we get permission denied errors from those child domain users trying to access parent resources with that networkshare_access group.
Help?

Answer 1

This is expected & by design. You can use domain admin from root forest to administer child domain users whereas vice versa is not possible. Secondly, enterprise admin account is required when you are doing forest level changes & that account only
exists in root domain. You need to make child domain users member of administrator group into root domain or use AGDULP method to provide permission in child domain to add/delete/modify users in parent domain
AGUDLP(Accounts, Global, Universal, Domain Local, Permissions)method to add user in groups.
-Add the User Accounts to Global Groups> Global Groups to Universal Group> Universal Groups to Domain Local Groups > Domain Local Groups to the group you want to assign the permission.
Accessing resources across forests
http://technet.microsoft.com/en-us/library/cc772808%28WS.10%29.aspx
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.