Just to let you know,

I disjoined from domain, deleted computer account, rejoined to domain and this fixed the problem

Adding a domain user/group to a local SAM group works. But as i checked the group after adding, it reports only the SID for the AD Users/Groups with the ghost...

No the users have the same properties and permissions. There are users in the same OU and in different OU's it does not make a difference.

No no audit failures for...

time is sycronised between all servers and DNS resolution to all domain controllers is working