URL:
https://github.com/SSSD/sssd/pull/484
Title: #484: SDAP: skip builtin AD groups in sdap_save_grpmem()
sumit-bose commented:
"""
@fidencio, on the AD side you have to add a group from the BUILTIN domain, e.g.
'Users' or 'Administrators', to a normal security group which can be read
by SSSD. When calling 'getent group' for this security group you should find the
group from the BUILTIN domain in the cache as well with 'gidNumber=0' but
'isPosix=True'. With the patch the group should not be in the cache anymore.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/484#issuecomment-356540216