Four types of authentication are used across forests:

(1) Kerberos and NTLM network logon for remote access to a server in another forest;

(2) Kerberos and NTLM interactive logon for physical logon outside the user’s home forest;

(3) Kerberos delegation to N-tier application in another forest; and

(4) user principal name (UPN) credentials.