ehlo,
attached patch should fix ticket #2926
The default case (no adding, no removing services) is tested by pam-srv-tests.
If the patch is not ready for stable branch sssd-1-13 then we might merge this case with GPO code which uses slightly modified way using hash tables.
LS