Your network contains two Active Directory forests named contoso.com and fabrikam.com.
The contoso.com forest contains two domains named corp.contoso.com and contoso.com.
You establish a two-way forest trust between contoso.com and fabrikam.com.
Users from the corp.contoso.com domain report that they cannot log on to client computers in the
fabrikam.com domain by using their corp.contoso.com user account.
When they try to log on, they receive following error message:
“The computer you are signing into is protected by an authentication firewall. The specified account
is not allowed to authenticate to the computer.”
Corp.contoso.com users can log on successfully to client computers in the contoso.com domain by
using their corp.contoso.com user account credentials.
You need to allow users from the corp.contoso.com domain to log on to the client computers in the
fabrikam.com forest.
What should you do?

A.
Configure Windows Firewall with Advanced Security.

B.
Enable SID history.

C.
Configure forest-wide authentication.

D.
Instruct the users to log on by using a user principal name (UPN).

Explanation:
The forest-wide authentication setting permits unrestricted access by any users in the trusted forest
to all available shared resources in any of the domains in the trusting forest.
http://technet.microsoft.com/en-us/library/cc785875(v=ws.10).aspx