This is a known issue affecting NSX-T Data Center.
Workaround:
In such cases, NSX-T should be configured to connect to the AD Global Catalog (GC) of the primary domain and then each subdomain should be configured as an alternative domain name for that configuration.
The Global Catalog service usually runs on the primary AD domain controllers, and is a read-only copy of the most important information from all the primary and secondary domains.
The GC service runs on port 3268 (plaintext) and 3269 (LDAP over TLS, encrypted).
For example, if the primary domain is "example.com" and with subdomains "americas.example.com" and "emea.example.com"
1) Add AD example.com using either the LDAP protocol on port 3268 or the LDAPS protocol on port 3269
2) Configure the alternative domain names "americas.example.com" and "emea.example.com"
Users in one of the subdomains must log in using the appropriate domain in their login name.
For example, user2 in the emea.example.com domain must log in with the username "
[email protected]".