Hi, I'm not even sure how to describe what is happening exactly as I'm not sure myself, but I'll try: I have an AD Synchronizer that pulls in new computer objects under a specific OU. It is supposed to drop new computers into a "New Systems" folder and use an RDP template with specific settings, and all that seems to work.
However, when a teammate of mine logs in, any work I have done in the New Systems folder (like moving things to which folders they should be in) is overwritten, and all of the objects come back to that folder. This makes me think it's not really the AD Sync doing it but something else. As an example, I had two print servers moved from New Systems to the folder for Print Servers. I just did it a few hours ago today. However, if I look now, those entries are 1) not in the Print Servers folder and 2) back in New Systems. It shows "created by" my colleague 22 minutes ago (as of right now) on those server objects in RDM.
I assume this is not a bug, but something set up incorrectly on my part. Any idea what I need to change? I don't want to keep moving/organizing systems if all my work is going to get reverted each time someone else logs in.
My data source is MS SQL. AD Synchronizer is set to automatically run every 1440 minutes. "Silent mode", "Verify folder on mismatch" and "Action on entry mismatch: Delete" are set in the AD sync settings.
I'd be happy to provide any more details as needed.
Hello Neil.
Thank you for your reply
From my understanding, with the "Action on entry mismatch:" set to "Delete" any changes made to the entries will trigger them to be deleted during the next sync.
We do have the following knowledge base article regarding the configuration of Synchronizer entries which I'm hoping will be helpful in your case:
https://docs.devolutions.net/kb/remote-desktop-manager/how-to-articles/configure-active-directory-synchronizer/
Let me know if this helps,
Best regards,
Samuel Dery
So I guess I've misunderstood that setting for a while now. Do I want to set it to "None" then? With the synchronizer I just want it to add a new entry for a new machine found in AD. I don't want it to remove anything existing, I clean up the entries for removed servers manually.
I suppose I thought the "Delete" action meant it would delete/prevent a duplicate entry.
Hello Neil,
Thank you for your reply,
Correct, that may be more suitable in your case.
That being said, to avoid any Duplicates, you can set the "Duplicate Check" under the "Search" section to "Root" With this configuration, it will ensure not entries with the same type or Host are imported.
Let me know if this helps,
Best regards,
Samuel Dery
I made some progress by setting it to "none" instead of "delete", but after my colleague logged in again today, all of the entries were duplicated. It did not delete the previous entries, but created a new entry in my "New Systems" folder matching the already existing one.
I do have the Duplicate Check set to Root already (and always have).
Could this be caused by a configuration file or something? It seems like the Synchronizer just because it creates the entries in the New Systems folder.
Hello,
Thank you for your reply,
I see, that is indeed odd, when you performed the sync from your end did it work as expected, or did you have the same behavior as when your colleague performed the sync automatically.
I'm also wondering if there were any changes to the "Host" or entry type of the entries before the sync?
Let me know,
Best regards,
Samuel Dery
Actually no, it didn't work. I deleted all the duplicate entries from the "New Systems" folder and manually ran the Synchronizer. Sure enough, all of the entries are there again. This time they say "Created by <me>".
There are no changes made to the entries once they are synced--I use a template for importing things from AD so everything is uniform. The only thing that changes is what folder I have them in.
Hello,
Thank you for your reply,
I see, the Mismatch is most likely caused by the fact that the entries have been moved into a different folder, I've discussed your case with our development team and they have informed me that this is something they are investigating to see if it could be improved.
Unfortunately, for now, I'm afraid this would be the expected behavior.
Let me know if you have further questions,
Best regards,
Samuel Dery
Hello,
With version 2024.1 of RDM, we have improved the Active Directory synchronizers to match by unique identifier.
What does this mean? This means that RDM is now able to update the synchronized entries rather than having to recreate them, which makes the synchronization process more intuitive and changes a lot of behaviors users found weird. Please note that on your first synchronization on 2024.1, RDM will update all the missing identifiers, and on subsequent synchronizations, it should update the entries provided the identifier is still found within Active Directory.
I would encourage you to try out version 2024.1 and see if the behavior works for your scenario. If it doesn't, let us know and we will see if there is a specific configuration that might work better, or if there are still more things we could add to the synchronizer to support what you require.
Regards,
Hubert Mireault