In a one-way AD trust the trusting domain needs to query the trusted domain's DC in order to add a security group to a folder's NTFS permissions. When challenged for Network Credentials an RSA passcode is required but the trusted (queried) domain doesn't use RSA.
