You will need a superuser that can login for administrative purposes. So don't change the existing superuser to NOLOGIN unless you create another superuser first (but tgen you could just as well rename the existing superuser). The secure thing to do is
use a good password for the user
severely restrict access for that user in pg_hba.conf, ideally to local ...
Like mentionned by James, if Tom didn't see the database with SA privilege, then it means the issue is somewhere else...
I'm having the feeling that Tom is not connecting on the same instance you are.
Select @@servername "server", SERVERPROPERTY('instancename') "Instance";
from both machine and check if you get the same result.
I don't see how it is possible for tom to have sysadmin rights and not see a database.
Does tom still have sysadmin rights with with the new version of SSMS? Normally refreshing or closing and re-opening SSMS is all that is required
Are you sure he is connecting to the correct server? Sometimes there is a dev or test server with a similar name that the ...
This is an old thread, but it was the first hit on Google when I encountered the same issue.
My two cents:
In my case it turned out that the AD group was a Distribution group, instead of a Security group, hence it could not be used to grant access to SQL Server.