Powershell – Querying for Disabled AD Users in PowerShell

Adi was right, it is some sort of permissions issue. I actually resolved this just now when a coworker ran the query and got proper results, however he used his own login account. Im addition he "ran as administrator" to elevate the PS console. When I did this it worked correctly. I have no idea how I never had to do this in the past, and also I am a domain admin and therefore local admin on the DCs, but whatever. It now works using elevated PS prompt. For the record I went into ADSIedit with my regular using account and did not launch elevated session.....Strange but I'll take it.

I can not give a more qualified answer without seeing the sssd debug logs, but the bug report you're referring to only had performance implications, not functional.

The reason you're able to su to the account from root is that the PAM stack normally includes pam_rootok.so module that bypasses authentication with pam_sss. Given the auth from root works, we at least know that retrieving identity information works, but not auth.

I would recommend adding more information to this question either here or on the sssd-users list. Most importantly, sssd debug logs with a high debug_level from the domain section and the krb5_child.log.

Please find more information in the troubleshooting document on the SSSD wiki.