I have found that you can't resolve the group in the resource domain even if you log in from a domain controller in the resource domain.