remove all yum updates and apt-get upgrades except from roles specifically designed to do this eg apt-get upgrade role

sssd uses the ldapDomain rather than the ansible_domain to template sssd.conf. Hopefully machines will work with sssd even with domain resolution (hostname -d)