This is a corner case but it is real. It may apply to regular groups, not just Unuix Cluster Account groups.

Unix Cluster Accounts configured with the default group set as 'create a new group for each account'. LDAP provisioner is being used but CoPerson has not been provisioned yet, and the CoPerson does have a cluster account and a group exists.

When the LDAP provisioner is run for the first time via 'Reprovison All', the CoPerson is provisioned to the People Base DN, but the Unix Cluster group is not created/provisioned in the Group Base DN. Running 'Reprovison All' will create the Unix Cluster groups.

This would be a particular problem when a new or scrubbed LDAP instance is created for an existing population. The work around would be to 'Reprovison All' twice.