I'm assuming nslcd should be disabled in ipa-client-install, just like nscd, but there is a ton less code that would do that, and there are some bugs probably related to the off-by-one character of nslcd vs nscd.

Then there is this code:

    nslcd = services.knownservices.nslcd
    if nscd.is_installed():
        save_state(nslcd)

This pretty obviously should be if nslcd.is_installed()

The installer goes through a lot of trouble to ensure that nscd isn't running. I wonder if it should go through similar trouble to ensure that nslcd isn't running. Otherwise the state is saved without really doing anything. This state saving was done for ticket https://fedorahosted.org/freeipa/ticket/3790 to ensure that state was restored, but what if nslcd is already running when ipa-client-install is executed? Presumably it will be disabled in the pam stack but the service will continue to run, right?

authconfig seems to be restarting the nslcd service for some reason:

2016-02-16T02:27:14Z DEBUG stderr=
2016-02-16T02:27:14Z DEBUG Saving StateFile to '/var/lib/ipa-client/sysrestore/sysrestore.state'
2016-02-16T02:27:14Z DEBUG args=/usr/sbin/authconfig --update --nisdomain company.com
2016-02-16T02:27:14Z DEBUG stdout=Starting nslcd: ESC[60G[ESC[0;32m  OK  ESC[0;39m]

That's about as far as my investigation went. This came in via IRC from immotus who saw errors in his logs of nslcd trying to contact his AD server.