|
1 | 1 | --- |
2 | | -title: Delta AD Group Discovery Doesn't Detect Membership Changes in Groups in Nested OUs |
| 2 | +title: Delta AD Group Discovery Doesn't Detect Group Membership Changes in Nested OUs |
3 | 3 | description: Troubleshoot an issue in which AD Delta Discovery fails to detect group membership changes in child organizational units. |
4 | 4 | ms.date: 01/12/2025 |
5 | 5 | ms.reviewer: kaushika, jarrettr, brianhun, payur |
6 | 6 | ms.custom: sap:Boundary Groups, Discovery and Collections\Active Directory Discovery (all types) |
7 | 7 | appliesto: |
8 | 8 | - <a href=https://learn.microsoft.com/lifecycle/products/microsoft-configuration-manager target=_blank>Supported versions of Configuration Manager</a> |
9 | 9 | --- |
10 | | -# Delta AD Group Discovery doesn't detect membership changes in groups in nested OUs |
| 10 | +# Delta AD Group Discovery doesn't detect group membership changes in nested OUs |
11 | 11 |
|
12 | 12 | ## Summary |
13 | 13 |
|
14 | | -Active Directory Group Discovery (AD Group Discovery) in Configuration Manager uses different algorithms for delta and full discovery cycles. During the delta discovery process, Configuration Manager doesn't process child organizational units (OUs). This behavior can cause delta discovery to miss group membership changes when groups belong to nested OUs within your discovery scopes. |
| 14 | +Active Directory Group Discovery (AD Group Discovery) in Configuration Manager uses different algorithms for delta and full discovery cycles. During the delta discovery process, Configuration Manager doesn't process child organizational units (OUs). Because of this behavior, delta discovery might miss group membership changes when groups belong to nested OUs within your discovery scopes. |
15 | 15 |
|
16 | | -This article helps you identify this issue in your environment, and provides workarounds to ensure that Configuration Manager detects all group membership changes. |
| 16 | +This article helps you identify this issue in your environment, and provides workarounds to make sure that Configuration Manager detects all group membership changes. |
17 | 17 |
|
18 | 18 | ## Symptoms |
19 | 19 |
|
@@ -51,7 +51,7 @@ To see what this behavior looks like in the ADSGDis.log file, follow these steps |
51 | 51 |
|
52 | 52 | 1. Open ADSGDis.log in a text editor, and then review the log entries to identify any discovery cycle. |
53 | 53 | 1. For that discovery cycle, create a list of the discovery scopes that appear in the log entries. |
54 | | -1. Verify the LDAP path of each scope. In particular, validate that the affected group is in a child OU of another one in the list. The example that this article uses, the scopes and paths resemble the following example: |
| 54 | +1. Verify the LDAP path of each scope. In particular, check that the affected group is in a child OU of another one in the list. In the example that this article uses, the scopes and paths resemble the following example: |
55 | 55 |
|
56 | 56 | ```output |
57 | 57 | !!!!Valid Search Scope Name: Unaffected Group Search Path: LDAP://CN=GROUP-A,OU=OU-A,DC=FOURTHCOFFEE,DC=COM IsValidPath: TRUE |
@@ -82,7 +82,7 @@ To see what this behavior looks like in the ADSGDis.log file, follow these steps |
82 | 82 | INFO: Processing search path: 'LDAP://OU=OU-A,DC=FOURTHCOFFEE,DC=COM'.~ |
83 | 83 | ``` |
84 | 84 |
|
85 | | - 1. Delta discovery identifies the search path for the child ou (OU-B in the example) as an invalid path, and skips it to process the next path. |
| 85 | + 1. Delta discovery identifies the search path for the child OU (OU-B in the example) as an invalid path, and skips it to process the next path. |
86 | 86 |
|
87 | 87 | ```output |
88 | 88 | INFO: Found invalid Search Path: LDAP://OU=OU-B,OU=OU-A,DC=FOURTHCOFFEE,DC=COM. Probably it's sub search path of other search path and will be covered by them. |
|
0 commit comments