I've got one AD forest with a root domain and a child domain, are you saying the AD plugin will not allow me to query the child domain if configured with the root domain or vice versa?
Do you know when this is likely to be supported? This is quite strange since I can easily query the root domain from the child domain even with a delegated user account that only has read permissions on the root domain but full domain admin rights on the child domain.
I created a custom workflow to try this and it finds the OU but I get this error:
Failed to create user group... [LDAP: error code 21 - 00000057: LdapErr: DSID-0C090C3E, comment: Error in attribute conversion operation, data 0, v1db1 ]