I have two Win2k8 forests which I do maintenance on. The two forests have full 2 way external, non transitive trust with each other.

I have a folder in forest X, domain countryX.mycompany.com accessible ONLY by the global security group named $group.

In forest Y, domain countryY.mycompany.com, countryY\user1, countryY\user2 etc needs to have access to the folder.

The natural instinct is to put user1, user2 etc into the $group. However, none of the methods for adding user to group works as it appears that the AD cannot find the groups in the other forest.

Question: 1.How to make forests see each other's security groups and be able to add? 2.In practice, what is the recommended way to achieve the user access to the folders/files in another forest?