Hi Sumit,
Thanks for taking the time to reply.
This morning I've done some further testing and found that granting the group "DOMAIN\Domain Computers" permissions to "Read remote access information" on the OU where the users who are going to authenticate against the SSSD clients works.
I've attached an image below, but I'm not sure if it'll be recorded for prosperity by the mailing list so explain it in text form too...
* Open Active Directory Users and Groups
* Navigate to the OU where your users are located (by default that'll be domain -> Users, but in a mature domain this is likely to be elsewhere. You could also do this at the root of the domain, but I'd not recommend it... privilege of least access and all that. Think about your highly privileged accounts, e.g. Domain Admins etc)
* Right click on the OU, click the Properties and select the Security tab.
* Click Advanced button
* Click Add
* Click "Select a principal". At this stage you need to make a decision.. which principle should I use? You could use Domain Computers, but you may feel this is too wide a group as it contains all the computers in the domain. At the opposite end of the spectrum you could use the computer account of the SSSD client (ie, the computers name); this would be a very narrow scoped permission which would allow ssd to work.. but could cause an administrative headache when adding additional SSSD clients. A sensible middle group might be to create a group (eg, "SSD Clients"), use that as the principle for this permission and then add all your SSSD clients to this group.
* Select "Type" as "Allow"
* Select "Applies" To as "Descendant User objects"
* Select "Read remote access information" and make sure all other boxes are ticked.
I found the GUI would by default tick all the Read permissions by default. To save me having to untick everything I made sure all the boxes in the Permissions section were Unticked, then switched "Applies to" from "Descendant User objects" to "Descendant Trusted Domain objects" and back to "Descendant User objects", this would untick everything. Then I could just tick "Read remote access information"
Regards
Steve