If a user name exists both locally and in Active Directory, which account is used, and what does default_domain_suffix change?

The local account wins, because /etc/nsswitch.conf lists files before sss; default_domain_suffix only lets domain users log in without typing @domain.

* Sources are asked in order and the first one that knows the name wins. *

/etc/nsswitch.conf tells the system where to look up names, and in which order:

passwd: files systemd sss
group:  files systemd sss

The lookup stops at the first source that knows the name. files (the local /etc/passwd) comes first, so a local davdur hides the AD user davdur. This order is deliberate: local admin accounts must keep working when the domain cannot be reached, and a domain account must not be able to take over a local system account by having the same name.

default_domain_suffix = g001.ckteck.com in the [sssd] section lets domain users type only davdur instead of davdur@g001.ckteck.com. It does not change the order, so name collisions are still a risk and are best avoided by policy.

Go deeper:

• man7.org: nsswitch.conf(5) — the syntax, sources and the actions on not-found.
• Wikipedia: Name Service Switch — what NSS is and which databases it covers.