I have a problem in which our international offices create there own domains and outside of our forest/child domains. Our root forest Horns.com and the child where all users & lcs reside Hookem.Horns.com. these users are trying to open up messenger to our lcs server lcs01.hookem.horns.com. They user credentials for hookem\userid with userid@hookem.com. They have been doing this just fine with some domains but recent domains not within our forest root don't seem to work.

Strange and puzzling. We can see netmon traces to and from the user authenticating. they get a 401 non-authorized error when they try to login on a machine in their domain. When they remove the machine from that domain they successfully login.

Any ideas what could be occurring?