I've had the system administrator check the AD groups and they are Domain Local Security Groups.  Should they be Global or Universal instead?

Domain local groups should be ok if everything is in the same domain. If you're working with multiple domains, universal groups are recommended. 

Here is the reply from the customer's System Administrator:

The problem is that we have users in two separate trusted domains.  You can only place/include users from “trusted” domains into Domain local groups.  I have even tried to nest the groups accordingly: Global -> Universal -> Domain (the Microsoft standard).  I still can’t add users from other trusted domains into the universal group.

Microsoft definition:

A universal group is a security or distribution group that contains users, groups, and computers from any domain in its forest as members. 

Note: The yyyy.org and zzzz.local are separate domains, yes, but in different forests.  The domain local is the only one that can cross-forest, not universal security group.

Is there another option you want to explore?

1. One way we might be able to get this to work is if we could authenticate to O365/Azure, since both accounts are present in our tenant.  Warning, though, the account suffixes are yyyy.com and zzzz.net. 

1. Still another option, and I think the easiest to implement, is to utilize Azure Active Directory Services.  Laserfiche would need to be joined to yyyy.net domain in Azure.  Not a problem since Laserfiche is already built there.  Groups could be created there and authentication would be a snap.

Hi:

Even though the Windows groups I used for the Active Directory sync have been added to the LFDS groups of the same name, I seem to be having problems with getting any groups to be imported, and therefore seen, within my Forms test environment.  I also had a look at the group type for one of the AD groups I set up, and I changed it from a Global to Universal security group (synchronizing my changes first to Directory Server, and then to my Forms test environment), but the one specified group I had modified still did not show up as a group under Named Users within System Security.

Might there be anything else I could check, with respect to this group, to ensure the group can be seen and used within my Forms test environment?

Thanks to anyone who has any suggestions on this! 

Marty Gaffney - Network Technician
Town of Okotoks