I have a handful of Mac's running Mavericks and up. Each Mac is generally used by 1-3 people. Each person is a member of a specific AD group.
Pre-deployment we added that AD group to the "Allow Administration By" field with "domain\groupname" format. Pre-deployment and shortly after deployment, the end users were able to administer the Macs without issue. They could escalate processes with their credentials.
Since then, none of the Macs recognize our users as administrators anymore, myself included (I'm in a separate AD group membership that was added at the same time). We then started going into each user profile and checking the "Allow user to administer this computer" checkbox, which again worked for a time but no longer does.
We have started falling back on the local administrator user account to manually authenticate when needed, but we're not able to share that password with end users.
The following link is what I used for reference: https://support.apple.com/en-us/HT202112
Is there something we're missing? Why would the administrative behavior work for a time then just stop?
Edit: This is not a duplicate to AD User as an administrator on the Mac?. I have tried all of the steps outlined in the link I originally referenced. The key issue is that I do actually get local administrator privileges for a short period, but then for some unexplained reason, all users but administrator lose their privileges and no longer escalate privileges.