Tory,

Some of the directives specified seem unnecessary. For example since you're using a ldaps URI there's no need to implement TLS directives, and since the LDAP backend is AD many of the attribute mappings are likely unnecessary as well unless there's something we don't understand at play. Perhaps simplify the config first.

I would try the following and test.

# ldap_id_use_start_tls = true
# ldap_service_port = 636
ldap_tls_reqcert = allow
ldap_force_upper_case_realm = true
ldap_uri = ldaps://aadds.com
ldap_search_base = dc=aadds,dc=com
# ldap_user_object_class = posixAccount
ldap_default_bind_dn = aadds\sssd
ldap_default_authtok_type = password
ldap_default_authtok = somearbitrarycrap
ldap_tls_cacertdir = /etc/openldap/cacerts


# Unix to AD attribute mapping
ldap_schema = ad
# ldap_schema = rfc2307
# ldap_user_object_class = person
# ldap_group_object_class = group
# ldap_user_home_directory = unixHomeDirectory

# ldap_user_modify_timestamp = whenChanged
# ldap_user_principal = userPrincipalName
# ldap_user_name = sAMAccountName
# ldap_user_gecos = displayName
# ldap_user_uid_number = uidNumber
# ldap_user_gid_number = gidNumber
# ldap_user_shell = loginShell
# ldap_group_name = uniqueMember

-- lawrence