Herbert from Microsoft support team has authored a great topic about Kerberos Forest Search Order (http://technet.microsoft.com/en-us/library/configure-kerberos-forest-search-order-kfso(WS.10).aspx). KFSO allows finding a service principal name (SPN) in multiple forests, and had little public information available on Microsoft websites previously. The topic covers how the KDC and Kerberos GP policies work, both at a high-level and with steps illustrated in detail. The settings require Windows Server 2008 R2 and Windows 7 or higher.

Also available in German: http://blogs.technet.com/b/deds/archive/2012/03/13/ich-glaub-ich-steh-im-wald-kerberos-hilf-mir-suchen.aspx 

Active Directory MVP Jorge also has a detailed set of related blog posts,including this one that covers setting the relevant GP settings: http://jorgequestforknowledge.wordpress.com/2011/09/14/kerberos-authentication-over-an-external-trust-is-it-possible-part-6/

Justin [Active Directory Documentation team]