I did find the Thread regarding Re: Add Users to Global Group AND/OR Porject level groups CAN NOT find DOMAIN outside build server

I believe that the necessary Active Directory permission is "Read". In a Domain Controller/DNS machine I've been using for some of my local testing, the Domain Users group has the following effective permissions. My service account is only in this group:

Read
Create All Child Objects
Delete All Child Objects
Send To
Read Phone and Mail Options
Write Phone and Mail Options

The two "Child Objects" permissions are so my domain users can add and remove machines from the domain. The rest of the permissions were set for Domain Users by default when I created the DC/DNS.

Hope this helps-

Cheers,
Adam

Adam is correct that the required permission is read. The App Tier Service user needs to be able to read the active directory user/group object for every user and group referenced by TFS. The place where this often causes problems in when a one way trust is involved. If the Service user is not able to read AD objects in one of the domains, you will not be able to add users and groups from that domain.

--Matt Hoover