On Fri, 18 Sep 2015, Ondrej Valousek wrote:
Nope,
See the last sentence:
"When connected to Active-Directory Server 2008 and later it is furthermore
required to disable usage of
Token-Groups by setting ldap_use_tokengroups to false"
I understand it the way that if you have a newer DC, you need to disable tokengroups
usage.
*If* you want to disable nested group processing, then yes, you need to
disable both.
jh