[Freeipa-users] AD groups detected only on one ipa server

[iulian roman]

Hi everybody,

I have an IPA setup  with AD trust and when I added a new group in AD it is detected only on one ipa server (I have 2 ipa servers in replication mode). 
getent group correctly returns the group only on one IPA server, therefore only the ipa clients enrolled to that ipa server can see the group. 
In the sssd logs I can see the following error:

[ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null).

If i try to add the AD group as external to a IPA group , by executing:  ipa  group-add-member ad_group --external "[e-mail]" 
, I get the following error:

member group: [e-mail]: trusted domain object not found

Any idea how can I solve or troubleshoot it?