Our campus hosts an on-prem Active Directory domain; Linux users I support run Ubuntu. Ultimately I'd like to implement the use of adsys to configure Ubuntu systems, but before trying to tackle that I'd like to resolve an issue I've run into with SSSD's GPO-based access control. I can successfully join Ubuntu systems to our AD domain, domain users can authenticate and home directories are automatically created, etc. However when I've executed "systemctl status sssd" I had been seeing the notification
"Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode."
I didn't see that there were any GPOs that would have been read by SSSD that would have generated that message so I modified the debug level for various SSSD-related logs. It seems as though it was after I executed "sssctl debug-level 0x0400 --domain <our campus domain>" that the
"Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode."
messages stopped. At that point I changed "ad_gpo_access_control = permissive" to "ad_gpo_access_control = enforcing", put a test system into an OU with a GPO that implements an ACL, and things seem to be working the way I would expect. I'd like to figure out why those warning messages appeared in the first place and what changed that made them stop. What information, logs, etc. would be helpful?
