ISE-PIC and multiple trusted Active Directory domains

[JOHN PAUL MORRISON]

I've got ISE-PIC setup for testing. 

I am seeing active sessions logged after setting a group policy to enable "Audit Kerberos Authentication Service" and "Audit Kerberos Service Ticket Operations" 

My problem is this only shows users logging in to the joined domain/join point. 

There are two ways trusts and other users log in to domain machines - I want to track these users/IP addresses as well.

[Romzy]

Unable to understand your question.

[JOHN PAUL MORRISON]

ISE-PIC is joined to DOMAIN1

DOMAIN1 and DOMAIN2 have a two way trust

I only see identities/IP addresses for users in DOMAIN1. 
When a user logs in as DOMAIN1\username I don't see any session/IP address

[Greg Gibbs]

I assume you mean "When a user logs in as DOMAIN2\username I don't see any session/IP address". I that correct?

I'm no AD expert, but AFAIK ISE can use the two-way trust to query the directory in the second domain but I don't believe DOMAIN2 will share login events with DOMAIN1 for ISE to consume via Passive ID.

If you want to see login events for DOMAIN2, I would expect you would also need to have a DC from DOMAIN2 added using either WMI or the Agent.