Thanks Jakub. Unfortunately we're on a mandated linux distro (RHEL/CentOS 7) so we're tied into their releases. Currently 1.15.2. We've definitely still got the groups issue.
An id -G returns a table of numbers with no errors, an id -Gn doesn't. We get at least one missing group with 'cannot find name for group ID' <group id>
This looks like the getgrgid() call as mentioned in the troubleshooting document - thanks. Now I'm thinking, could it be something is broken in the AD setup.