Make a user from one domain a member of Domain Admins of another domain

You can't do what you're asking. Users from one domain can be added to the "Builtin\Administrators" group of another domain, which will allow them to manage all Domain Controllers in that domain, but this isn't the same as giving them Domain Admin, which provides implicit admin rights on all members of the domain.

This is typically accomplished in one of two ways:

  1. Each admin has one Domain Admin account per domain that they must manage.

  2. Their admin account from their "home" domain is added to the Builtin\Administrators group and is made a local admin on all domain members via GPO restricted groups of GPP group preferences.

As you've said, global groups can only contain security principals from their own domain and the Domain Admin's group scope cannot be altered.


To address your edits - they will have similar permissions to the Domain Admins group at that point.