topic Missing sync of AD security group from endpoint server in Endpoint

Missing sync of AD security group from endpoint server

Peter_Bjeldbak — Thu, 19 May 2022 12:56:42 GMT

Greetings all !

I use a security group in my AD to pinpoint workstations eligible for FDE. Thus I have rule, where an AD security group is the dynamic "target" - This has worked out perfectly so far.

Alas (otherwise i wouldnt be writing this post) the "link" seems broken to the AD security group.

I can see worksstations in my AD - but when looking into the deployment rules - the reflection of the group are missing several members .

As i understand - using security group for deployment secures dynamic updates - where virtual groups lack that ability.

I have other rules depending on the AD connection - whích works fine - but those are based on virtual groups instead of Security groups.

I have tried removing said group and reapply it - to no avail.

I feel confident the connection between server and AD is at least partial working - since i can browse my AD from endpoint server.

Hope this makes sense !

Any ideas?

Kind regards

Peter

Re: Missing sync of AD security group from endpoint server

G_W_Albrecht — Thu, 19 May 2022 14:05:14 GMT

I would suggest to contact TAC to resolve this issue !

Re: Missing sync of AD security group from endpoint server

Michi — Mon, 23 May 2022 09:04:08 GMT

Do you have an AD Scanner running?
Secondly, the AD Scanner only checks in a frequency of 120 Minutes (TAC told me there is no shorter time span possible) for any changes in AD and syncs that into the CP DB.

This means that if you change a AD security group and add a Client - it can be up to 120min Delay in worst cases until CP notices that ..

BR ME

Re: Missing sync of AD security group from endpoint server

Peter_Bjeldbak — Mon, 23 May 2022 14:08:30 GMT

SOLVED !!

So - found out my ad scanners was "frozen" ... not progressing - but neither failing (the Gui suggested the scan was in progress - but no progress was to be seen)

After contacting suppport - I ended up with the below suggestion.

1. Enter SSH to the Endpoint Management Server.
2. cpstop
3. cd $UEPMDIR/engine/uepm-jms-data
4. rm *
5. cpstart

Which did the trick - my scanners once again pulls data every 5 minutes - JOY !!

kind regards

Peter