winbind not enumerating groups for users after login on RHEL7

Issue

A RHEL 7.2 system becomes a member of a domain named ABC(abc.example.com) The AD domain controller for the domain is a Windows based host.
The ABC domain is a child domain of the EXAMPLE (example.com) domain. There is a two way trust between the two domains.
Before an EXAMPLE domain user (e.g. EXAMPLE\test_admin for illustration purposes) logs into the system all their extended EXAMPLE domain groups are enumerated.
When the user actually logs in, only some of their extended groups are enumerated. Any operations relying on these missing groups then fails. For example, group based security access control relying on the missing groups fails.