Starting with Windows Server 2003, and Windows 2000 SP4, you must explicitly enable Allow Cross-Forest User Policy and Roaming Profiles at Computer Configuration\Administrative Templates\System\Group Policy, to allow user based policy processing, roaming user profiles, and user object logon scripts, for cross forest interactive logons.
The Explain tab contains:
This setting affects all user accounts interactively logging on to a computer in a different forest when a Cross Forest or 2-Way Forest trust exists.
When this setting is Not Configured:
- No user based policy settings are applied from the user's forest.
- User will not receive their roaming profiles, they will receive a local profile on the computer from the local forest. A warning message will be shown to the user, and an Event Log message (1529) will be posted.
- Loopback Group Policy processing will be applied, using the Group Policy Objects scoped to the machine.
- An Event Log message (1109) will be posted stating that Loopback was invoked in replace mode.
When this setting is Enabled, the behavior is exactly the same as with Windows 2000 Server Family (pre SP4), user policy is applied and a roaming user profile is allowed from the trusted forest.
When this setting is Disabled, the behavior is the same as Not Configured.
