XGS 19.5.3 Build 652 - AD Group members lost

See User Authentication:  Sophos Firewall: Backend Group Membership in Sophos Firewall 

Essentially if you add something manually, it will be override by the next authentication. 

ok, this is understandable.

But then why doesn't it affect all users that I have manually added to groups?
And why aren't the users pushed directly into the same AD groups that AD says they belong to?
Or, better asked, how can I configure the synchronization so that all users are added to the correct groups so that I don't have to rework it manually?

ok, this is understandable.

But then why doesn't it affect all users that I have manually added to groups?
And why aren't the users pushed directly into the same AD groups that AD says they belong to?
Or, better asked, how can I configure the synchronization so that all users are added to the correct groups so that I don't have to rework it manually?

Like mentioned in my article: SFOS will do a first match principle of all groups and ask the AD Server for each login request. If a user logs in with whatever method, it will fetch the default group and backend groups.

BTW: UTM never showed the groups at all.

Check the backend memberships, sort your AD Groups properly in the group window and then the user should appear in the right groups. 

Sorting the AD Groups inside the xgs group section did the trick, thank you very much

Sorry, 2 days later the problem is still unsolved.
Some users remain in "Open Group", even though i put that group at the bottom of the Group list and the user memberships are correct.

I purged the AD users but it didn't do anything visible. Shouldn't that delete the users from the xgs?

Only if the AD User is not available in AD. 
What backend users do you see for this user? 

Sorry, could you explain what you mean?

Please visit my Link above. There is a Screenshot about backend membership. 

This specific user has no other memberships than Open Group