In an Exchange resource forest scenario mailboxes are created with disabled (for logon) Active Directory (AD) accounts in the local forest and associated (linked) with master accounts in an external AD forest. These are called linked mailboxes in Exchange.
By default Good for Enterprise (GfE) 7.x does not allow provisioning of disabled accounts. A disabled account normally means an employee that left the company. As a security precaution Good for Enterprise 7.x checks for the state of the AD account and pauses the account if the user object is disabled in Active Directory.
In a resource forest scenario the check for disabled active directory accounts will cause GfE to pause all its accounts associated with linked mailboxes effectively blocking the users of these mailboxes from enrolling their device.
The most simple solution is to disable the checking for disabled accounts by adding a registry key and a tweak of config.props. All the details and other solutions can be found in the Good public knowledge base.