Thank you for the information, I do indeed see what you mean:
[sssd[be[ipa.engr.tamu.edu]]] [sdap_check_ad_group_type] (0x0400): Filtering AD group
[linux_team(a)engr.tamu.edu].
Is there any way to force SSSD not to filter out the domain local groups? We use almost
exclusively domain local groups in our AD because our users often reside in a different
domain than the groups due to circumstances out of our control. This particular group
(linux_team(a)engr.tamu.edu) only contains users in the same domain as the group, but this
is often not the case. I had planned on creating a trust to both domains, the domain that
contains the groups (and some users), and the domain that contains the bulk of our users.
On a very puzzling note, when I first set up my IPA domain, I was able to get back results
from a 'getent group linux_team' that properly contained all of the group members.
However, I could only get this to work on the IPA server. When I tried this on a client I
got the results that I am seeing now. During the process of debugging I stopped getting
any members returned on either client or server. This is particularly strange because all
of my settings appear to be the same as before when it was working on the server.