5 Replies Latest reply on Apr 22, 2009 8:30 AM by zman

    Directory Manager not Refreshing Active Directory,

    Rookie

      We are using Software deployment via Active Directory, and we just add machines to the Global Security Active Directory Groups, and at the set interval of time, Scheduler service used to talk to DC, and get the updates if any. This has stopped, We need to manually resolve queries in LANDesk to get the machines targeted in respective Policies.


      Can anyone suggest a solution,


      LANDesk is linking into AD ok , but it taking far longer to resolve queries than it should do , based on past experience.


      I have change the query interval to 5 minutes , and have re-started the scheduler service , but there is still a delay in queries being run.


      There are no event viewer messages indicating a problem , and you can browse the ad directory manually via 'directory manager' within LANDesk , so authentication isn't the cause.

       

      As a short term fix we tried rebooting LANDesk Server to see if it picks up the correct DC. But this doesnt worked for us.

       

      Is there any way to check which DC LD01 is querying as this DC may be out of sync?


      I'm very reluctant to disconnect and reconnect the existing connection to LDAP as this could delete the APM targets, Please share your thoughts on the same ??

       

      Would really appreciate if anyone can help me with this,

        • 1. Re: Directory Manager not Refreshing Active Directory,
          zman Master

          Couple of items. To see if the queries are being resolved you can right click the saved query in directory manager and select run or test query to see it resolves (add a user/computer to a group then run the query to see if it resolves - if not then the dcs are taking a long time to sync or not syncing at all).  Also check the schedqry logs on the core along with apmservice, ldapresolver, schedsvc logs.  The names may be a little off since this is all from memory and I don't have a core at my fingertips. You can't tell LANDesk to go to a specific DC, this is by design and I believe it just does ldap queries to whatever DC responds.  I've seen schedqry get hung sometimes - this is spawned by the apmservice service. Make sure schedqry is running and the logs are being updated. Yeah don't disconnect and reconnect you will be screwed.  Also make sure the account you are using is not locked out. I'm assuming you are using active directory.  It works we have over 1300 policies going off of ldap. Schedqry runs its @ss off.

           

          What version/SP LANDesk are you running?

          1 of 1 people found this helpful
          • 2. Re: Directory Manager not Refreshing Active Directory,
            phoffmann SupportEmployee

            A couple of other things:

             

            * DC's out of synch ... you will want to look into that and fix that. You cannot configure LANDesk to talk to a specific DC - that goes somewhat against the whole point of an AD.

             

            * Bear in mind that LDAP requests are treated as LOWEST priority by DC's - so if your DC's are otherwise busy (potentially because they host applications that require a lot of power, or you just have loads going on in your AD), then be prepared to see delays here.

             

            * Roughly...

            - how many nodes do you have?

            - how many DC's do you have?

            - how many queries do you try to resolve?

            - how long have you set the query interval to?

             

            In particular the last one is important - setting the query interval too aggressively will mean we (re-)start to evaluate queries before we're finished ... so some/a fair few queries will potentially never be resolved.

             

            * As ZMAN pointed out, make sure that the user you're accessing the AD with is not locked out - generally the tests he's suggested are spot on.

             

            Paul Hoffmann

            LANDesk EMEA Technical Lead

            1 of 1 people found this helpful
            • 3. Re: Directory Manager not Refreshing Active Directory,
              Rookie

              Thanks Zman and Paul Hoffman. I really appreciate for your replies. But somehow i feel that i did not explain the problem fine.  


              Let me re phrahse it. Queries are being resolved Manually. In an APM if i would click Perview query results, i would get all the machines added to AD group within next second as APM Target. Same works if i click Test Query in Directory Manager. If i add an Group to Active directory, that group also gets reflected next time i look into Directory Manager.


              The problem is that, It is not automatically picking up the new members added to the various Active Directory groups.


              The account(s) for connecting to AD and running  we are using is not Locked out, i mean both the accounts used for scheduler service and Directory manager are set to Password Never Expires. We are using LANDesk 8.1 GA2.


              Out of the logs mentioned by Zman in schedqry.log i found the following errors


              Wed, 22 Apr 2009 09:40:37 Failed to get group members for  (80004005)
              Wed, 22 Apr 2009 09:40:37 Failed to resolve ldap query
              LDAP://XXXX.co.uk on (cn=XXXX.app.A00006 ArcFM(removal))
              Wed, 22 Apr 2009 09:40:39 Failed to resolve ldap query
              LDAP://XXXXs.co.uk on (cn=XXXX.app.A00006 ArcFM)
              Wed, 22 Apr 2009 09:40:43 Failed to resolve ldap query
              LDAP://XXXX.co.uk on (cn=XXXX.App.Prism_3.7(Removal))
              Wed, 22 Apr 2009 09:41:13 Failed to get group members for  (80004005)

              Wed, 22 Apr 2009 09:41:24 Failed to resolve ldap query LDAP://XXXX.co.uk on (cn=XXXX.app.activesync_3.7.1)

              Wed, 22 Apr 2009 09:41:48 Scheduled Queries Complete
              Wed, 22 Apr 2009 09:47:43 Scheduled Queries Stated, Command Line /query=512 /policy=1092
              Wed, 22 Apr 2009 09:47:43 Failed to resolve ldap query
              LDAP://XXXX.co.uk/CN=123,OU=Application Groups,OU=Admin,DC=XXXX,DC=co,DC=uk on Members Of This Group
              Wed, 22 Apr 2009 09:47:44 Scheduled Queries Complete

               

              To answer Paul's queries,


              • We got close to 1100 nodes
              • Got 6 DC's
              • AD has got close to 400 Queries, and Service Desk guys keep on adding members to various groups as and when requested
              • Initially we had set the query interval to 15 minutes, but when the problem arose last week, we set it too 5 min to investigate, but now on the basis of your response we have modified to 30 minutes now.


              I think i have given sufficient information to explain, in a nut shell Manually it is working fine, but it's not picking up the members automatically. I would really appreciate, if you guys can help me sorting this mess out.

               

              Regards

              Manoj Khera

               

              • 4. Re: Directory Manager not Refreshing Active Directory,
                Rookie

                Guys, Seems like setting up the Query limit has worked for me. As of now, it seems like picking machines from the group. Thanks heaps for your support.

                i will come back here, in case what i have seen stops working again.

                 

                Thanks a ton for your help again.

                 

                Regards

                Manoj Khera

                • 5. Re: Directory Manager not Refreshing Active Directory,
                  zman Master

                  Cool, might want to think about upgrading since there are/will be significant improvements in LDAP support.