Re: [SSSD] should ad-gpo support additional logon rights?