When running lsgroup -a ALL on AIX Unix Enabled AD groups are being returned twice.
# lsgroup ALL | grep vasgroup
vasgroup id=1000 users=karl,marcb,admin,nick registry=VASMU
vasgroup id=1000 users=karl,marcb,admin,nick registry=VAS
When joing the machine to AD we add both VAS and a VASMU registry to the methods.cfg file. Even though VASMU is specified as authonly, name service queries are being answered by it aswell the normal VAS registry.
Use the -R option with lsgroup lookup to only query against the VAS registry
eg. # lsgroup -R VAS ALL
If you are not using mapped-users on AIX, you can remove/comment out the entire VASMU registry section in the /usr/lib/security/methods.cfg file being careful to preserve the spacing in the file.
Waiting for fix in a future release of Quest Authentication Services