0
Answered

AD Sync changes configuration for multiple object classes

Bob Bradley 5 years ago • updated by anonymous 3 years ago 2

In a FIM 2010 sync configuration we now have contacts, users and groups under management, with multiple AD MAs. One configuration option I am considering is consolidating all AD run profiles in a single EvB operation, considering a change to one object type will necessitate a delta import for each of the 3 AD MAs we have in place (same domain - different purposes).

The LDAP query I am trying is the following:

(|(&(objectClass=group)(groupType=-2147483644))(&(|(objectClass=user)(objectClass=contact))(objectCategory=person)))

i.e. give me changes in any security group, contact or user.

The initial query understandably took some time to execute (since I have 59664 objects matching this query) but seemed to work OK. Can I expect that this query will be effective when subsequently run every 10-15 seconds, or is there another approach that's preferable?

The reason I ask is that a user account deletion occurred which didn't trigger an import, so I decided to reconfigure this and give it a more specific query (has anyone else had trouble with deletes not being detected?).

No investigation required here - just a short response on/direction to best practice advice really. I am going to revisit CSODBB-172 today as well ... still to settle on the optimal EvB configuration here, so I will be trying a few different ideas but am keen to understand the constraints I am working with.

Topic for the pending PIR - simply to review Event Broker configuration is optimal (including CSODBB-225).

No longer observing this behaviour for EvB 3.1