APM Active Directory Trusted Domains

Haven't found a specific answer to my question so figured I'd reach out the dev community. Dealing with a single forest multi domain environment. Smartcard access, all with the same UPN suffixes, lets say @domain.com. I need the ability to query for a UPN throughout the entire forest. Now...

I have already tried the route of querying the GC. And that is fine except it does not return the users actual domain which I need in my SSO KCD object. So I have been experimenting with Active Directory Trusted Domains where you can specify more than one AAA server. So in my case, I put DC1 and EXT_DC1 in this profile. DC1 is in the root Domain A and EXT_DC1 is in the Child Domain B. I have the AAA server DC1 specified as the root in the Active Directory Trusted Domains profile.

My AD query in my Access policy will only query this domain controller before failing. So it works for any user who is in Domain A, but any user in Domain B it fails for.

Any advice would be greatly appreciated.

Thanks