No, there isn't AD users in my FreeIPA domain. We use a role-based access to resources, and it is a reason why I search in compat - in many situations we need to see indirect member UIDs in groups. The point is that the output is not the same for X.X.X.X and Y.Y.Y.Y replicas. May be I expressed incorrectly, but in fact I have a two questions: 1) Why same ldapsearch question to different replicas in FreeIPA return different results? In the post above replica X.X.X.X has no entries in answer, but replica Y.Y.Y.Y has one entry 2) Why replica X.X.X.X with search in SUBTREE scope returns one entry, but with BASE scope there is no entries in answer. I would like advice on where to look the answer of this replica's behavior.