Users Lose Permissions When an AD Forest has Multiple Domains