...
We are switching to bushy active directory at U Penn since the cn length of 64 does not let us provision our groups. This is also easier to delegate access. We will provision folders for apps that need it, or groups that need it.
Make sure you are pointing to an AD domain name with active/standby load balancing or to the primary node. Or there could be CNF conflict groups in AD created.
Install and patch pspng (see PSPNG at Penn)
...