Unit tests cover several aspects of this change, including ensuring that the new normalisation (in master only) spits out the expected results. In addition to this, you'll need to configure both auth_ldap and enrol_ldap and run some tests. Configuring your own LDAP server I've provided instructions for both Active Directory, and OpenLDAP Active Infectory Create some new Organisational Units (OU/containers) under moodle.test.com: -> moodle.test.com --> Builtin --> Computers --> Domain Controllers --> Foreign Security Principals --> Users --> Service <-- ******** --> Accounts <-- ******** --> Groups <-- ******** ---> 2016 <-- ******** ----> Students <-- ******** ----> Teachers <-- ******** Under 'Service' create a new 'moodle' account. Give it a password which does not expire and cannot be changed. Uncheck the force password reset flag. Under 'Accounts' create a number of new accounts. Give them a password which does not expire but can be changed. Uncheck the force password reset flag. Set an e-mail address for all of the users Under 'Groups/2016/Students' create some new Groups: 2016-ECON101 (pre-Windows 2000 name = 2016-STUD-ECON101) 2016-MATH101 (pre-Windows 2000 name = 2016-STUD-MATH101) Under 'Groups/2016/Teachers' create some new Groups: 2016-ECON101 (pre-Windows 2000 name = 2016-TEAC-ECON101) 2016-MATH101 (pre-Windows 2000 name = 2016-TEAC-MATH101) Place several users in each of the subject groups (ECON101/MATH101) OpenLDAP Set up OpenLDAP as per https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-a-basic-ldap-server-on-an-ubuntu-12-04-vps Create a structure as follows: -> dc=yourhost,dc=per,dc=in,dc=moodle,dc=com --> ou=service <-- ******** --> ou=accounts <-- ******** --> ou=groups <-- ******** ---> ou=2016 <-- ******** ----> ou=students <-- ******** ----> ou=teachers <-- ******** Under 'service' create a new 'moodle' account. Give it a password which does not expire and cannot be changed. Uncheck the force password reset flag. Under 'accounts' create a number of new accounts. Give them a password which does not expire but can be changed. Uncheck the force password reset flag. Set an e-mail address for all of the users Under 'groups/2016/students' create some new Groups: 2016-ECON101 2016-MATH101 Under 'groups/2016/teachers' create some new Groups: 2016-ECON101 2016-MATH101 Under each of the groups (ECON101/MATH101) add members using their dn, e.g. cn=springer,ou=Accounts,dc=auth,dc=banana,dc=per,dc=in,dc=moodle,dc=com Moodle setup Various things differ between AD and LDAP. Here are a few: bindDN: AD: moodle@moodle.test.com LDAP: cn=moodle,ou=Service,dc=auth,dc=banana,dc=per,dc=in,dc=moodle,dc=com Encoding: AD: cp1252 LDAP: utf-8 User type: AD: MS ActiveDirectory LDAP: posixAccount ID Number Attribute AD: sAMAccountName LDAP: entryDn member attribute (enrol role mappings) AD: member LDAP: memberuid The following instructions were made using AD. Refer to the above if using OpenLDAP Open auth_ldap settings and set: LDAP server settings: host URL: IP of your LDAP server Use TLS: No Encoding: cp1252 Bind settings: Distinguished name: moodle@moodle.test.com Password: (the password you set) User lookup settings: User type: MS ActiveDirectory or `posixAccount` Contexts: ou=accounts,dc=moodle,dc=test,dc=com Search subcontexts: Yes User attribute: sAMAccountName Data mapping: First name: givenName Surname: sn Email address: mail ID number; sAMAccountName ^^^ For each of the above set the update time to 'on every login' Open enrol_ldap settings and set: LDAP server settings: host URL: IP of your LDAP server Use TLS: No Encoding: cp1252 Bind settings: Distinguished name: moodle@moodle.test.com Password: (the password you set) Role mapping: Teacher: Context: OU=Teachers,OU=2016,OU=Groups,DC=moodle,DC=test,DC=com attribute: member Student: Context: OU=Student,OU=2016,OU=Groups,DC=moodle,DC=test,DC=com attribute: member Member attribute uses dn: Yes User type: MS ActiveDirectory or `posixAccount` Id number attribute: sAMAccountName Course enrolment settings Object class: (objectClass=group) ID number: cn Short name: cn Full name: cn Summary: cn Autmatic course creation settings Auto create: Yes Using Andrew's AD server Run the attached config script (mdl51723.php) run an auth sync: php admin/tool/task/cli/schedule_task.php --execute="\auth_ldap\task\sync_task" Check for errors run it again as the logic changes between creating and update users Check for errors Run the ldap CLI sync too: php enrol/ldap/cli/sync.php Check for errors Rerun Check for errors Open up your DB, find the users who were created, grab their IDs an enter them into a search such as: SELECT * FROM mdl_role_assignments WHERE userid IN (<list of ids here>); Make a note of the results Log into your site using the following credentials: username: springer password: Password1! Attempt to access one of the courses MATH101, ECON101 Rerun your DB query Confirm that the results have not changed Edit settings for enrol_ldap and change nested_groups = false user_type = Default #Â Re-run the CLI sync Re-run the SQL query and note the results Login again as our Jerry Springer again Re-run the SQL query no change in result count