MIM PAM elevated user cannot access active directory sites and policy's....

Question

Hello Guys,

I've deployed a PAM solution like the following: created a new bastion forest defined roles, PRIV users and candidates and a working sample pam web portal and PRIV users can have access to the roles and log into their machines once they have the roles. however, my issue is when a user takes the shadow principle and be member of the schema admins, domain admins and enterprise admins the user Connot access any of the group Policys, trust, only could access the AD sites and users.

and when trying to open the file share server as well and change to the PRIV domain to add users from it to be able to access the share on the source forest it won't let select the PRIV users or find them like I've done as the guide when delegating the PAM services accounts to the source AD

any help !