You need to ensure that the users in the branch office always attempt to authenticate to the domain controller in the branch office first