We have been syncing course enrolments from our Microsoft AD servers for about 8 months now. The groups are updated nightly and enrol cli script runs every morning after that just to make sure changes are pushed.
After upgrading to 2.9 last week:
-Every time a user logs in all their LDAP enrolments are disabled.
-I force a sync and the classes are enabled again (It shows up as enrolled in their profile)
-They log back in and the courses disappear again.
Groups and courses in LDAP have not changed, only the upgrade from 2.8+ to 2.9+. For the moment i've enabled flat file to give everyone course access.