$domain = "aforest" $otherDomain = "achild" $password = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force New-ADUser -Name "user-$domain" -AccountPassword $password -Enabled $true $localUser = Get-ADUser "user-$domain" -Server "aforest.ad" $otherUser = Get-ADUser "user-$otherDomain" -Server "achild.aforest.ad" New-ADGroup -GroupScope DomainLocal -Name "group-$domain-local-1" New-ADGroup -GroupScope DomainLocal -Name "group-$domain-local-2" New-ADGroup -GroupScope DomainLocal -Name "group-$domain-local-3" New-ADGroup -GroupScope DomainLocal -Name "group-$domain-local-4" New-ADGroup -GroupScope Global -Name "group-$domain-global-1" New-ADGroup -GroupScope Global -Name "group-$domain-global-2" New-ADGroup -GroupScope Global -Name "group-$domain-global-3" New-ADGroup -GroupScope Universal -Name "group-$domain-universal-1" New-ADGroup -GroupScope Universal -Name "group-$domain-universal-2" New-ADGroup -GroupScope Universal -Name "group-$domain-universal-3" Add-ADGroupMember -Identity "group-$domain-local-4" -Members $localUser Add-ADGroupMember -Identity "group-$domain-local-4" -Members $otherUser $otherGroup = Get-ADGroup "group-$otherDomain-universal-3" -Server "achild.aforest.ad" Add-ADGroupMember -Identity "group-$domain-local-3" -Members "group-$domain-universal-3",$otherGroup Add-ADGroupMember -Identity "group-$domain-universal-3" -Members "group-$domain-global-3" Add-ADGroupMember -Identity "group-$domain-global-3" -Members "$localUser" $otherGroup = Get-ADGroup "group-$otherDomain-global-2" -Server "achild.aforest.ad" Add-ADGroupMember -Identity "group-$domain-local-2" -Members "group-$domain-universal-2" Add-ADGroupMember -Identity "group-$domain-universal-2" -Members "group-$domain-global-2", $otherGroup Add-ADGroupMember -Identity "group-$domain-global-2" -Members "$localUser" Add-ADGroupMember -Identity "group-$domain-local-1" -Members "group-$domain-universal-1" Add-ADGroupMember -Identity "group-$domain-universal-1" -Members "group-$domain-global-1" Add-ADGroupMember -Identity "group-$domain-global-1" -Members "$localUser"