Comments

• That's right 
I created a test stand. 
Parent domain DN DC=BoLTik,DC=local 
Subdomain DN DC=GROVER,DC=BoLTik,DC=local 
parent access group Boltik-2FA-mOTP 
subdomain access group Grover-2FA-mOT 
…

  in AD users of child domains are not synchronized Comment by Andrew March 18
• There may be a problem with AD size. Ldapsearch gives an error: 

ldapsearch -h 10.10.10.10 -D 'DC=zao-agrokomplex,DC=ru;DC=RTL,DC=zao-agrokomplex,DC=ru;DC=BRCH,DC=zao-agrokomplex,DC=ru' -b 'DC=zao-agrokomplex,DC=ru'
&#…

  in AD users of child domains are not synchronized Comment by Andrew February 12