This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Dynamic group not processing

We are seeing random issues where random dynamic group are not processing new users. Upon research, I found out "Service to evaluate and apply rule changes" is empty. Immediately I pick a service server and hit rebuild, they start showing up. Why is this happening? Anyway to search ARS for dynamic groups without this information blank?

Top Replies

Terrance.Crombie over 5 years ago +1 suggested

This resource is relevant:

Title: Dynamic Groups and/or Scheduled Tasks not functioning after Active Roles upgrade
Solution: 211388
URL: https://support.oneidentity.com/kb/211388

0 Aidar.Karabalaev over 5 years ago

Possible reason: ARS Upgrade. Search all Dynamic Groups in ARS MMC and check/reset the current ARS01 server on each group.
Cancel
Up 0 Down

Cancel
0 akingbade.ajewole over 5 years ago in reply to Aidar.Karabalaev

Can I do this with PS? Thanks for your response
Cancel
Up 0 Down

Cancel
0 Aidar.Karabalaev over 5 years ago in reply to akingbade.ajewole

PS1 script - probably Yes.

Due criticality of DG feature and potential impact on AD security, during ARS Upgrade, I strongly recommend customer to use the chance to review the DG list and confirm it (Deprovision the legacy not needed anymore).
Cancel
Up 0 Down

Cancel
0 Terrance.Crombie over 5 years ago

This resource is relevant:

Title: Dynamic Groups and/or Scheduled Tasks not functioning after Active Roles upgrade
Solution: 211388
URL: https://support.oneidentity.com/kb/211388
Cancel
Up +1 Down

Cancel

0 akingbade.ajewole over 5 years ago in reply to Aidar.Karabalaev

Thanks. I was able to run this command to get all dynamic group

Get-QADGroup -LdapFilter '(edsaisdynamicgroup=True)' -IncludedProperties edsadgoriginatingservice,edsaisdynamicgroup -Proxy | Select-Object name,edsadgoriginatingservice,edsaisdynamicgroup | Export-csv C:\Users\5username\Desktop\Result.csv


Then I run the following against groups without the attribute.

clear
$list = import-csv “C:\Users\username\Desktop\ScriptsInput\groupattribute.csv"
foreach ($name in $list)
{
Get-QADGroup -SamAccountName $name.sAMAccountName -IncludedProperties edsadgoriginatingservice,edsaisdynamicgroup -Proxy | Set-QADGroup -ObjectAttributes @{edsadgoriginatingservice="ServerName.domain.corp"}
}