I have a fairly complex forest in which I have a primary domain, call it D1, this domain is trusted by my root domain, call it D2, but D1 does not trust D2. Now throw in a third Domain, D3, which is a child of D2, I need to add users from D1 to a group in D3 so they have access to all the child domains under group D3.
Illustration available on request