Home / user-464771

Justin Cervero's questions

Martin Hope
Justin Cervero
Asked: 2022-03-05 05:41:53 +0800 CST
  • 0

I've created a custom auxiliary class for the purpose of adding attributes to AD Group objects. I'm dynamically linking the auxiliary class to individual Groups. I can successfully add it to the objectClass of Group objects but I can also add it to other object types. I can't seem to find any clear documentation on how to restrict it to only Group objects. I've tried setting systemPossSuperiors/Possible Superior and it doesn't change the behavior.

It's not entirely clear that there is a way to restrict it but but other built in classes seem to demonstrate restrictions.

  1. Is it possible?
  2. If so, how?

Thanks.

active-directory ldap schema
Martin Hope
Justin Cervero
Asked: 2019-05-16 16:41:19 +0800 CST
  • 0

AdamSync is crashing periodically. In troubleshooting we found that it's throwing an exception when it encounters what it thinks is an empty DN. I replayed the query using the dirsync cookie stored in the ADLDS configuration. Dumping the returned values I find the following object:

CN=SCCM Site Server\0ADEL:0b9efaf1-24cc-46a1-92ff-f6aa74254d3e,CN=Deleted Objects,DC=appd,DC=appstate,DC=edu
description 
objectguid 0b9efaf1-24cc-46a1-92ff-f6aa74254d3e
instancetype 4
isrecycled TRUE

As far as we can tell, that object no longer exists. We can't find it using any of our tools: User & Computers, LDP, ADSI Edit, AD Admin Center, AD Explorer, PowerShell queries (all using the deleted/recycled filters, extensions, and flags). We have considered that it may have hit its tombstone and been processed by the garbage collector since the date specified in the dirsync query. If that's the case, would the attribute change record continue to be returned? Indefinitely? If it hasn't been processed by the garbage collector why can't we find it?

AdamSync crashing due to the value seems to be a secondary effect or a different problem altogether.

active-directory
Martin Hope
Justin Cervero
Asked: 2018-12-22 06:14:33 +0800 CST
  • 1

Connect your directories

When we get to the 'Connect your directories' screen in the setup process the forest is auto populated with the correct FDQN of the domain but the 'Add Directory' button is grayed out. We have tried entering the domain manually using the NETBIOS name and the FQDN. We've tried entering other domains. The button never activates. The setup logs show no errors or warnings. We've used Wireshark to try and see what it's trying to do on the network and there is nothing that stands out. We have tried running it on multiple servers and get the same result.

We have poured over the prerequisites and we have run the readiness tools. Again, nothing looks out of the ordinary. At this point we are at a loss.

Has anyone seen this before? Any suggestions on where to proceed next?

active-directory