An AD forest contains two domains, a parent domain and a child domain. It is possible to add and remove accounts, groups and contact objects from the parent domain to groups of the child domain of type "Universal" and "Domain local". This is also possible via LDAP - ModifyRequest.
Removing these memberships from groups of type "Universal" suddenly no longer works, even though Identity Manager shows them removed successfully.
This is due to Microsoft (MS) update patches applied to the Domain Controller:
Windows Server 2016: KB4462928
Windows Server 2012 R2: KB4462926, KB4462921
Windows Server 2008 R2: KB4462926
Since the error is distributed to all server versions with the MS Security Update of October 2018, there is a version of the ADS Connector which fires the Remove function blindly again with the DistinguishedName of the member when removing members from groups of type "Universal", after calling with the SID of the member. This affects performance, but the result is expected, until Microsoft has fixed the defect.
Please find the links for the hotfix containing the workaround below:
One Identity is working with Microsoft to resolve the issue.