I'll install the ldb-tools tomorrow (I went home) and try that out.

The SID and the RID are correct, verified visually and used a windows utility to search the domain based on the SID to verify it was correct and returning the correct account from AD (psgetsid.exe). I'm also working on converting the SID and RID to reverse hex so I can use ldapsearch on the linux machine to triple verify, but I haven't completed that yet.

The computers with SSSD version 1.9 correctly show the RID as the last digits of the unix UID. My default domain group is Domain Users as well, which always has a RID of 0513, and that correctly shows as the last 4 digits unix GID on the computers with 1.9.

Reading those bug reports more may had lead to a solution.

         ldap_idmap_default_domain_sid (string)
               Specify the domain SID of the default domain. This will
               guarantee that this domain will always be assigned to slice
               zero in the ID map, bypassing the murmurhash algorithm
               described above.

               Default: not set

           ldap_idmap_default_domain (string)
               Specify the name of the default domain.

               Default: not set

I'll try those out tomorrow as well. I'm not sure they'll work since I got them from version 1.9 docs. I don't have them set on the computers I have that use SSSD 1.9, and they don't exhibit the problem.

Thanks again,