How to grant permissions to an OU?

Question

Hello Community
In a network there are 2 forests (lets call them ForestA and ForestB).
In both forests there are administrators in their domains.
If  I wanted to put an administrator from ForestA into an OU in ForestB so that the administrator from ForestA could
 access resources in ForestB, but I don’t want that administrator to be an administrator in ForestB, how can I grant only “Read” permission to the “OU” so that the administrator from ForestA won’t have administrator privileges in ForestB?
Thank you
    Shabeaut

Answer 1

I'm not an expert in forest trusts, but I think you will need to examine the EnterpriseAdmins and DomainAdmins, in both domains/forests, before and after you establish the trust.
I think you will find that EnterpriseAdmins is the only cross-forest group that may grant "excessive" permimissions for your scenario.
You will likely get a lot more discussion on this DS topic, in the DS forum:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverDS
e.g. this discussion is a little similar, and several experienced DS professionals contributing to the discussion:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/fa4070bd-b09f-4ad2-b628-2624030c0116/forest-trust-domain-admins-to-manage-both-domains?forum=winserverDS
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)