When I first joined my PC running Ubuntu Studio 18.04 to an Active Directory (AD) domain, I opted for fully qualified names because the Ubuntu PC had local users with the same names as domain users. Now that I have things running satisfactorily with domain users, I have deleted the local users and would like to drop using fully qualified names. In /etc/ssd/sssd.conf, I changed:
use_fully_qualified_names = True
use_fully_qualified_names = False
This had the desired effect in that after logging in as a domain user:
However, it has some nasty side effects:
- Logged in domain users are missing several local group memberships which were evidently assigned automatically by PAM, such as: cdrom audio video plugdev users netdev ssh lpadmin scanner saned sambashare
- Logged in domain users can no longer access some files and directories, because the domain users now belong to the group "domain users", whereas the resources belong to the group "domain [email protected]", to which the domain users previously belonged.
How can I cleanly turn off the use of fully qualified names?
Are there better workarounds for the above-mentioned side effects than manually editing the group memberships?