When every directory user is suddenly locked out — but local accounts like root still work — the problem is almost always between the host and the directory, not the users themselves. On Linux, sssd is the daemon that talks to LDAP/AD and caches credentials, so that's where to look.
Read the sssd log
tail /var/log/sssd/sssd.log # "Can't contact LDAP server" / "Backend is offline" getent passwd someldapuser # empty = sssd isn't resolving the directory
Fix the connection
The usual causes are a wrong ldap_uri (a decommissioned DC), an expired TLS CA, or a bad bind DN — all in /etc/sssd/sssd.conf. Fix the URI, then restart and (if a stale cache is serving bad data) clear it:
ldap_uri = ldaps://ldap.internal:636 systemctl restart sssd # if stale cache misbehaves: sss_cache -E (expire all cached entries)
sssd's offline cache is a feature — it lets already-seen users log in during a brief outage — but it also means a bad config can appear to "half work." Always confirm with getent passwd after a fix.
Practise it
Directory/SSO outages are one of the simulator's access incidents. Work them in a full incident response shift.