Granting Domain Admin privileges to a cross-forest user account?

What I've discovered, that I'm hoping someone else can beat (by having these rights applies to existing objects) is:

1. Establish proper DNS communication between the two forests.
   • In my case, this required a DNS delegation zone and properly configured conditional forwarders.
2. Create a two-way, forest trust with forest-wide authentication.
3. Add the Domain Admins@OneForest group to the Builtin\Adminstrators@OtherForest group.
   • This effectively grants user-level privileges on OtherForest domain computers, and administrative privileges on the domain controllers for OtherForest.
4. Create a domain-local group in OtherForest and add the Domain Admins@OneForest group to it as members.
5. Create a GPO/GPP to add the group created in step 4 to the local administrators group on all your domain computers.
   •