- Use proper group names: inventory_admins (admin), inventory_users (user) - Use relative groups_dn: 'ou=groups' (not absolute path) - Matches original user's GUI-configured settings