So I already count as an AD expert? That is kind of you. No, I just managed thanks to Emma and others.
Whatever, our problems have some similarities: MS ActiveDirectory Windows 2012 R2 and the groups not in the same OUs as the users. But if the users were synced first (auth_ldap) and the contexts there include the OUs where the groups are, the plug-in will get them. It took me a long time to understand it.
If you still need real debug, you have to plant print_object($obj) in the code and let the database dump to the screen. See https://moodle.org/mod/forum/discuss.php?d=378935#p1528305.
Also note that the maintainer mentioned some last minute AD adjustments as late as 5 Sep 2018. So I'll be careful about the version of the plug-in.
Heads up, others are already confirming success https://moodle.org/mod/forum/discuss.php?d=160751&parent=1528907. @Emma, our "deep dive" was not in vain, after all.