LDAP User Profile Synchronization - including users from baseDn's other than the requested baseDn

With the implementation of Appian 22.3, we had to upgrade our LDAP Tools plugin to the latest version due to a java error.

This also required us to replace the LDAP User Profile Synchronization smart service nodes wherever they were used.

We copied parameters from the old version of the smart service into the parameters on the new nodes. The parameters were copied exactly.

Now, when these processes run, they are pulling users from "similar" baseDN's.

Example, when we try to sync baseDn "OU=ITS,OU=Depts,DC=abc,DC=company,DC=com", the node is also pulling users from "OU=Contractors,OU=ITS,OU=Depts,DC=abc,DC=company,DC=com". This assigns the Contractors to groups only intended for employees, presenting us with a possible security issue.

Is there a setting or filter that will force the Sync node to ignore the members of extraneous groups with "similar" baseDn string values?

Please note that the ldapsearch function works as expected and does perform this way.