My work laptop is bound to my office's AD server. In the Directory Utility, where the AD server binding is configured, the "Allow administration by" checkbox is checked and, beyond the default "domain admins" and "enterprise admins" choices, "DOM\domain admins" and "DOM\enterprise admins" are also there. Under the "User Experience" tab, "Create mobile account at login" is checked.
My normal user account (managed, mobile) doesn't have admin rights. When I need admin rights, I su - admin_user. The user admin_user is a member of the "DOM\domain admins" group. In the accounts preference pane, it shows up as admin, managed, and mobile. If I fire up terminal and type id, I see this admin_user as being a member of the following groups: everyone, netaccounts, com.apple.sharepoint.group.1, and DOM\domain admins (along with some other Domain-related groups that are probably just noise for this example).
When I head home, after some amount of time, the admin_account's membership in "DOM\domain admins" seems to disappear and I no longer have admin access via this account. All the other non-domain groups (everyone, netaccounts, and com.apple.sharepoint.group.1) are still there, but no Domain groups. Additionally, the account's main group -- which is an AD group -- can't be reversed to its textual representation, so only the group ID shows. Once I've get back to the office, the corporate domain-related groups reappear.
I saw this problem with Lion (10.7), but I see it much more frequently now that I've upgraded to Mountain Lion (10.8).
Ideas on how to stop this behavior and have the domain groups stick around?
