Stop clearing ADQuery Identity Awareness during policy installation

[David_Herselman]

Installing policy has the effect of clearing known user identity awareness, the primary reason why we advocate only handling this outside of business hours.

There are however often reasons why customers ask for policy installations during work hours, is there no way for a security gateway not to clear PDP during this process as user's internet access is subsequently inhibited until they restart their browser (initiates Kerberos browser based authentication as the browser handles captive portal detection), switches or cycles connectivity (initiates captive portal detection) or re-login (initiates ADQuery event)?

[PhoneBoy]

As far as I know, this shouldn't happen.

There's a note in our Best Practice documentation about something that happens during policy installation, namely we re-lookup all the LDAP groups associated with each user the gateway knows about.

Best Practices - Identity Awareness Large Scale Deployment 

That couldn't happen if we cleared all the users on policy installation.

I recommend opening a TAC case.