Your network contains two Active Directory forests named contoso.com and fabrikam.com.
The contoso.com forest contains two domains named corp.contoso.com and contoso.com.
You establish a two-way forest trust between contoso.com and fabrikam.com.
Users from the corp.contoso.com domain report that they cannot log on to client computers in the fabrikam.com domain by using their corp.contoso.com user
account.
When they try to log on, they receive following error message:
“The computer you are signing into is protected by an authentication firewall. The specified account is not allowed to
authenticate to the computer.”

Corp.contoso.com users can log on successfully to client computers in the contoso.com domain by using their corp.contoso.com user account credentials.
You need to allow users from the corp.contoso.com domain to log on to the client computers in the fabrikam.com forest.
What should you do?

A.
Configure Windows Firewall with Advanced Security.

B.
Enable SID history.

C.
Configure forest-wide authentication.

D.
Instruct the users to log on by using a user principal name (UPN).

Explanation:
The forest-wide authentication setting permits unrestricted access by any users in the trusted forest to all available shared resources in any of the domains in the
trusting forest.
http://technet.microsoft.com/en-us/library/cc785875(v=ws.10).aspx