Cross-forest user administration

Question

I have created a cross-forest trust between DSfW domain and MSAD domain. In both domains, I have added one user (call him CrossAdmin) as member of Builtin\Administrators group.
I can log in to DSfW domain as CrossAdmin and successfully administer users in MSAD domain using "Active Directory Users and Computers"). But the reverse doesn't work. If I log in to MSAD domain as CrossAdmin and in "Active Directory Users and Computers" try to switch to the DSfW domain, I get an error message:
"The domain dsfwdomain.oursite could not be found because: Access is denied".
At the same time, the following is logged to /var/log/messages on the DSfW server:
krb5kdc: [KDC] Regenerating authorization data for cross-realm client [email protected]
krb5kdc: [KDC] Failed to locate PAC principal data buffer
krb5kdc: [KDC] PAC lacks principal name authenticator
krb5kdc: [KDC] Ticket for client [email protected] is not bound to PAC
Is this a restriction by design, or can it be made to work somehow?

Answer 1

vatson,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://www.novell.com/support and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Forums Team
http://forums.novell.com