>> Don't quite follow here. I do have a local root user in
passwd/shadow
>> with
>> a
>> local pw as required by any UNIX I know. I also have a AD root
account.
>
> Lets get this straight, you have a user called 'root' in /etc/passwd
> and another user called 'root' in AD, is this correct ???
You should name your central user something else. SSSD will deliberately
not authenticate root because root should be authenticated by pam_unix.
That should be my decision, not enforced by SSSD.
Jocke