For Win9x: the 1355 error results when the domain where the KXRPC is running does not trust the domain where the local group resides. This just so happens to be the standard configuration of the master domain model. KXRPC is running on the master domain where the resource domains trust the master, but the master domain does not trust the resource domains. This configuration can not resolve local group in the resource domain.

For NT: The situation is slightly different. Since NT uses pass throught authentication, an NT workstation in a resource domain can verify local group in the domain where it is a member because it has a trust to that domain via the secure channel. INGROUP on NT can not resolve the local group of another resource domain unless it's resource domain trusts the target resource domain. This particular aspect is not required. It was just included for discussion.

This sucks. The only apparent solutions are either to build a complete 2-way trusts from the master domain to each resource domain or have each client use KXRPC on its local domain server.

Thanks Shawn for the time you invested.