Return
-
Title
Blocking AD group information from host -
Description
Is there a way to reliably block all group membership information from a QAS client? -
Resolution
One way to do this would be to remove the vas4 entry from the group line in nsswitch.conf. One problem with this situation is that the entry will be added back any time the host is reconfigured, so this may not be ideal.
A more permanent configuration change would be to set the "load-groups-ignore-path" vas.conf option to point to the root of your directory to prevent all groups from loading by default. Then you may set the nss_vas option "group-update-mode" to "none" to prevent forced group lookups.