Could you please let me know which is the lowest (minimum) sssd version on which the ldap_use_tokengroups = false configuration works against AD backend? The man pages say it was introduced in 1.12 but it seems to work in 1.11.7 as well. Does it work on lower versions 1.10 / 1.9 or is there a workaround to disable token group processing with 1.10/1.9?