This has started occurring after upgrading from 2.8 to 2.9.

• To duplicate:
  run "php5 /var/www/enrol/ldap/cli/sync.php" from the command line.

• Sample Output:
  == Synching course '09-PD' for role 'student'

Assign role to user '10724' in course '09-PD (907)'
Enabled enrolment for user '10724' in course '09-PD' (id 907)

• Log in as the user.

• The log shows all his enrolments are unassigned
  Course: 09-Personal Development System Role unassigned The user with id '1796' unassigned the role with id '5' from the user with id '1377'.

From what i can tell this is not a problem with the ldap setup as it will sync all of the roles correctly from cli. The enrols are only disabled at login so it has to be something in enrol_ldap (which runs at login)

This ldap sync has been working for the last 6 months on 2.8 without change.

I haven't been able to find any information about why this happens. Each time i run the sync manually it works/remains active. It will disable as soon as any user logs on.