8 Replies Latest reply on Apr 7, 2010 11:25 AM by jabramson

    Dynamic AD Groups

    Rookie

      If I add an AD group from directory manager to an scheduled task and say that I want the users in that group to have the application shows nicely in the Deployment Portal for the AD user.

       

      But if I add another user to the AD group that I added into the scheduled task, this person will not get the application in the Portal until I restart the scheduled task.

       

      Is there any posibility to get this a little more dynamic? Without having to restart the task every hour/day/week etc?

      I want to add and new user into an AD group and when he logs on, the portal gives him the right applications as the users that has been in the AD group earlier.

       

      Is this possible?

       

       

      Regards

      Are

        • 1. Re: Dynamic AD Groups
          zman Master

          What version/sp of LANDesk are you using? The groups are dynamic in the sense it will be updated based on how often you have the scheduler set to evaluate the tasks/queries (Configure LANDesk Services | Scheduler Service | Interval between query evaluations).  Depending on what version/sp you have is needed because the process has changed from version to version.  You should dnot have to restart the task. Is the target being updated on the console?

          • 2. Re: Dynamic AD Groups
            Employee

            Under Configure | Services | Scheduler there is an option in the middle that is for query evaluations.  When you add another machine to an AD group it will get targeted once the query is re-evaluated.  If you have the query evaluation set to 8 hours, it will add the machine 8 hours from the last time the queries were evaluated.  This feature actually is dynamic.

            • 3. Re: Dynamic AD Groups
              Apprentice

              I have this set to 15 mins which presumably is the default as i have not changed it.

               

              Is that excessive?  Do the evaluations demand a lot of the core/db/pdc?

              • 4. Re: Dynamic AD Groups
                phoffmann SupportEmployee

                The default is, actually, 1 hour.

                 

                The queries CAN be intensive, it depends.

                 

                The problem with AD queries is that LDAP queries get worked off with LOWEST priority by the DC, so depending on how busy your DC is (or they are, in case you have several), this can be a problem.

                 

                Also not that IF the interval is set too aggressively and we don't complete the query resolution, we WILL re-start at the appointed time.

                 

                So if you were to need 20 minutes to resolve queries, and set the query interval to 15 minutes, you would never complete resolving queries, causing yourself various issues.

                 

                Paul Hoffmann

                LANDesk EMEA Technical Lead

                1 of 1 people found this helpful
                • 5. Re: Dynamic AD Groups
                  Apprentice

                  Thanks for the info Paul.

                   

                  I will turn it down a bit.

                  • 6. Re: Dynamic AD Groups
                    Rookie

                    This helped a lot. Thanks for all the answers.

                    • 7. Re: Dynamic AD Groups
                      phoffmann SupportEmployee

                      It occured to me that I forgot (Doh) to point out a few things.

                       

                      If you need to "time" the query evaluation process, there's a few tricks and log-files to help you with.

                       

                      First off - Re-starting the scheduler service WILL force the re-start of query evaluation, so this is a handy piece of information on the side.

                       

                      Next, the single most useful log-file to look at is in LDMAIN / the ManagementSuite directory on the Core. This is -- "SCHEDQRY.EXE.LOG"

                       

                      In particular the following two entries will make your life easier:

                       

                      Query Resolution start:

                      ""

                      29/01/2009 13:57:20 : Evaluating user scopes in prepartion to updating all active policies
                      29/01/2009 13:57:20 : Evaluating queries for all active policy tasks.

                      ""

                       

                      <At this stage we go into each query and task, all rather uninteresting>

                       

                      Query resolution end
                      ""

                      29/01/2009 13:57:21 : Cleaning up orphaned packages.
                      29/01/2009 13:57:21 : Scheduled query resolution has been completed.

                      ""

                       

                      Now - if you DON'T see a "Scheduled query resolution has been completed." before seeing another "Evaluating queries...", it means your queries never complete being resolved. The time-stamps also give you an idea as to how much time this takes (and then - in turn - how much room to play you have).

                       

                      A recommendation from me is to always add at least (!) 5 minutes to the time it takes at the moment to resolve queries, so as to allow time for growth in the future.

                       

                      Paul Hoffmann

                      LANDesk EMEA Technical Lead

                      • 8. Re: Dynamic AD Groups
                        jabramson Apprentice

                        I was searching through and found this post. My LANDesk version is 8.8 SP3.

                         

                        I understand that queries are re-evaluated after 1 hour and I did check the log to verify this. The question is, if I have a software deployment task policy or policy-supported push set with an LDAP query, will it autopopulate the computer into the scheduled task and redeply after the query is re-evaluated without having to re-run the task at a future time? Also, do I have to use a pre-requisite query to prevent reinstall of the application by running it the first time by using "devices that did not suceed" or something along that.

                         

                        By the way, I did test this and it seems to work because it will be re-evaluated and when you look at pending, the name (Associated LDAP object name) is searchable in the pending. However the associated device is not.

                         

                        Thank you.