title: AD Permission denied when adding a user to a group in a trusted domain
body: <p>I have 2 domains with a two way trust between them. I want to modify a group on one of the domains but running on the other domain.</p>
  
  <p>Lets say the domain I am running my script on is mydomain.com, and I would like to add a user to yourdomain.com</p>
  
  <p>I tried through VBScript as well as DSMod, but get permission denied</p>
  
  <pre><code>dsmod group "CN=DCComics,OU=Comics,DC=yourdomain,DC=com" -addmbr "CN=Dark Knight,OU=Comics,DC=yourdomain,DC=com"
  </code></pre>
  
  <p>When I run the above, I get this</p>
  
  <pre><code>dsmod failed:CN=DCComics,OU=Comics,DC=yourdomain,DC=com:Insufficient access rights to perform the operation.
  </code></pre>
  
  <p>I'm able to query data on yourdomain.com and I have checked the trusts are working just fine. I have logged in as administrator on mydomain.com. </p>
  
  <p>Ideally I am looking to do this in VBScript, so I wrote this just to test:</p>
  
  <pre><code>user = "LDAP://CN=Clark Kent,OU=Comics,DC=yourdomain,DC=com"
  group = "LDAP://CN=DCComics,OU=Comics,DC=yourdomain,DC=com"
  Dim objgroup
  SET objGroup = GETOBJECT(group)
  objGroup.Add(user)
  </code></pre>
  
  <p>Once again, I get an error about permissions:</p>
  
  <pre><code>C:\tmp\foo.vbs(6, 1) Microsoft VBScript runtime error: Permission denied
  </code></pre>
  
  <p>Any guidance where I need to muck about with permissions for this? Might I add, I am still learning about AD, so please be gentle :)</p>
  
  <p>Thanks</p>