Cross Forest Resource Security

Create/ensure they have a forest level transitive trust 

Create a domain local security group 

1. This group will be what is assigned to the resources. 

2. File shares, delegated AD permissions, etc should point to the domain local group 

Create a universal security group 

1. This will be what the users are added to 

Assign the universal groups as a member of the domain local groups