nss.enumeration.enable

Control whether adclient returns AD entries for NSS enumeration (setpwent/getpwent, setgrent/getgrent, shadow, and all other NSS maps such as services, hosts, networks, protocols, and rpc).

This does not affect by-name or by-id lookups (getpwnam, getpwuid, getgrnam, getgrgid) so AD users can still log in and be resolved when enumeration is disabled. Enumeration of the entire zone is resource-intensive and, in most deployments, unnecessary.

The default is true, which keeps the existing behavior:

nss.enumeration.enable: true