Problem
You are experiencing timing issues in combination with Active Directory replication because the domain controller you specified in the AD plugin isn’t being used during group creation and nesting.
Solution
Do not specify the domain controller in the AD plugin. LoginAM will then select the domain controller and wait for replication to occur before continuing.