If a group_plugin is configured, use it to resolve groups of the form %group as long as there is not also a system group of the same name.
Normally, only groups of the form %:group are passed to the group_plugin.
This flag is off by default.
This issue is frequently seen when using non-Unix enabled groups in your sudoers configuration, but it has been seen with Unix enabled groups as well.
vastool configure sudo will configure sudo to allow access control based on Active Directory groups that are not Unix-enabled. The location of the configuration file (sudoers file) will be determined automatically if visudo is in your PATH. Alternatively you can provide the path to visudo with the -V option, or the path to a sudoers file with the -f option.
2 - Configure the always_query_group_plugin option in the sudoers file: