Access Rules should have an "All Forest Domains" membership

[FriedrichWeinmann]

As in "For each member domain, the entity with SamAccountName equal '%name%' should be a member in this group"