This patch changes the Active Directory functionality a bit: now the group membership is only checked when an actual restriction on groups is active. If not, not groups are retrieved.

This can also be considered a workaround for issue 1267

Patched and implemented at my workplace