Hi all, I have new OTRS5 installed for test replacing our old ticket system. I have setup agent auth from AD (Samba4 - Zentyal). This woks. Users are authorized and new agent is created in OTRS. I can map Roles and Groups from AD too. Roles map/sync work, but Groups map/sync work weird.... Ad groups: IT, HelpDesk OTRS group: IT Users in HelpDesk have access to OTRS, but only in initial OTRS group "users" Users in both HelpDesk and IT have access to OTRS with IT group, role, queue. But... 1. Agent login to frontend, in log I see User: 'XXX' sync ldap group IT! , in Agents <-> Group mapping I see all checkbox IS selected for this user/group 2. Logout 3. Again login same agent, in log I see User: 'XXX' sync ldap group IT! , in Agents <-> Group mapping I see all checkbox IS NOT selected for this user/group 4. Logout 5. Again login same agent, in log I see User: 'XXX' sync ldap group IT!, in Agents <-> Group mapping I see all checkbox IS selected for this user/group 6. ... etc. Every login switch group mapping This is part of my Config.pm $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'member'; $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN'; $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [ 'users', ]; $Self->{'AuthSyncModule::LDAP::UserSyncGroupsDefinition'} = { 'CN=IT,OU=Groups,DC=domain,DC=xx' => { 'IT' => { ro => 0, rw => 1, }, }, }; Any idea what may be wrong? Thanks. ZS-Man