I am trying to lock down security including removing the leaked password hashes that the UNIX addon creates. I removed Authenticated Users from the Pre-Windows 2000 Compatible Access group. However after doing this, a small portion of users could not log into various non-Windows things like Redmine, Subversion, our VPN etc. These services authenticate with a ldapbind user account and then use SSL LDAP to authenticate against AD and check group membership. We also use Linux machines running SSSD that authenticate via Kerberos and check group membership with LDAP.
The problem I found is that group membership could not be enumerated for a small amount of users. They can be authenticated but not authorized. For example if I log onto a Linux box and do "id user" nothing would be found for these users. However "id user" would return the information for most of the users. I can't think of any difference between the user accounts that work and those that don't. What could be going on?