Groups not resolving names across Trust

Question

Hello
Looking for some guidance if possible.
We are having issues resolving names across an External Trust.  We are looking to nest groups.
We have
Domain 1 : Server 2012 running Windows 2008 R2 Domain/Functional Level
Domain 2: Server 2000 running Windows 2000 Native Domain/Forest Levels.
Trying to nest a group from Domain 1 into Domain 2. It adds the group but when you check the members it then only shows a SID and not the friendly name.
We have Domain 3 (Windows 2003) and this works fine for nesting groups from here into Domain 1 and Domain 2.
Not sure if it is:
Firewall - Sure we have all ports open from 1024 > 65xxx. But we also have DCs on same sites
RPC I could not see any GPOs restricting this?
DNS and Trusts look healthy
Any suggestions would be appreciated.

Answer 1

This is most likely a DNS issue.  Ensure that the member server that you are reviewing the group members is pointing to a DNS server that has conditional (Or a Secondary) that points to Domain 1.  There may be a time right after you add a group
that the Foreign Security Principals need to be populated (You can check the FSP container in Domain 1 - It should be at the root of the domain) and see if the Domain 1 members are within the container.
http://searchwindowsserver.techtarget.com/news/1195097/Foreign-security-principals-and-the-Active-Direcory-architecture
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.