I have a directory which staff are allowed to sftp into on an Ubuntu 18.04 server. The directory is root:www-data owned (it's a web server) and I've set chmod +t and chmod g+s so data cannot be accidentally deleted and when new files and folders are added they automatically have the proper group for Apache set.
On my test server which is the same OS minus Active Directory authentication, the above configuration works exactly as expected. Local test accounts with various groups can all sftp to the server, upload files and all files and folders are consistent in group membership of :www-data.
On on the prod server with AD authentication the group is constantly overwritten to be 'domain users' ignoring the chmod g+s setting when users drop new files in. Both files and folders created on this server exhibit the 'domain users' group rather than inheriting as expected.
Any ideas what I might be missing?