Active Directory Group Discovery not picking up Workstation OSs

We don't use the default 'workstation' container in AD. We have a OU called:i.e. 'contoso workstations'. Within 'contoso workstations are other OUs by location: i.e.: 'Bangalore'; 'Harare'; 'Bangkok': and 'Djibouti'. AD Group discovery dumps everything
into All Systems with no logical organization of locations. We need those location folders so we can throttle client deployment. How do I get Discovery to pick up OU 'locations' and populate those locations with workstations?

Are you talking about AD site? If so, that's collected by system discovery and heartbeat discovery. Thus, if you aren't using System Discovery, you'll have to wait until heartbeat discovery reports in for the client. Based on this info you can create
appropriate query based membership rules for collections that have you manually created. However, this is a bit of chicken and the egg if you want to use it for client agent installation since heartbeat discovery is only reported by client agents themselves.
Thus, you should either enabled AD System Discovery or choose an alternate deployment method like a startup script.
Jason | http://blog.configmgrftw.com

Similar Messages

SCCM 2012: Active Directory Group Discovery, Delta Discovery?

Hi,
Our scenario:
*Software is requested via a seperate system which puts AD computer objects in groups
*Software within SCCM 2012 is deployed to computer collections
*Computer collections query AD groups, in those AD groups the pc's reside
*Collections memberships run via AD query (every 20 minutes)
*We deploy an OS (Windows 7) via SCCM
*Machine policy is updates every 20 minutes
What is important: AD Group discovery is set to full discovery every 7 days, delta discovery set to 15 minutes
So what happens:
*Pc is staged correctly with Windows 7 but software isn't coming through in time (sometimes it's there within the hour, sometimes it takes 6 hours)
*If we run a full AD Group discovery mostly software is installing immediately
*Sometimes a SCCM 2012 client machine reset policy or reinstall client solves the problem
My questions:
*Would it be better to run full discoveries every x minutes since this always solves our problem
*Would it be better to disable the delta discovery if we do the change above to minimize AD queries
=> tried that now (full discovery every 30 minutes and disabled delta discovery) but I don't want to put to much pressure on our domain controller
*Our software collections are limited to all systems, we could limit them to a Windows 7 collection. Probably we should do that but any suggestion how to do this safely in Powershell?
Please advise.
J.
Jan Hoedt
Note: what I don't get is why a full ad discovery system discovery sovles the problem since SCCM 2012 collections do a AD query, what 's the link there?

So, let me see if I get this correct for our situation:
Our own developed system puts pc’s in AD groups
SCCM 2012 polls these groups, by default 1/week full discovery then every 30 minutes a delta discovery
We deploy software to computer collections, these collections check the SCCM 2012 database every 30 minutes (collection update) Note: the query our collection do, is based upon requirement of Windows 6.1 + membership of an AD group.
The SCCM 2012 client/computer does a computer policy update every 30 minutes to see what collections it is member of and see then the software to be deployed
2 questions:
*Our my assumptions correct? Specifically point 3.: is the query fully coming from an ad sync (or also from sccm client, f.e. Windows 6.1%)?
*Don’t we have a step to much then, wouldn’t it be better to add a direct membership of the AD group within SCCM? This direct membership would mean no query and so save us about 20 minutes (run of query)?
Jan Hoedt

Active Directory System Discovery not discover 'correctly'

Hi,
I am having a very strange problem with some devices in my environment.
The operating system of these is discovered as 'Windows 7 Entreprise 6.1' which causes a lot of my queries to fail.
Normal from my point of view would be 'Microsoft Windows NT Workstation 6.1' (which is correct at 90% of devices in the same OU)
Where is the difference to others?
I already deleted those devices fully from SCCM and I checked the AD for 'Operating System' attribute (which is the same for both types of devices.

i checked my console and i see all the entries for operating system are start with ' Microsoft windows NT'.the value that you are referring in the screen is custom attribute called 'operatingSystem' and that value cannot be seen in the console .and it
is not added to the discovery method by default. May be you can try deleting the computer object from SCCM and let the discovery happens again.
Eswar Koneti | Configmgr Blog: www.eskonr.com | Linkedin: Eswar Koneti
| Twitter: eskonr

Lion Server not reading Active Directory Groups reliably

I am trying to upgrade one of our XServes from Snow Leopard Server to Lion Server and am running into a strange issue with our Active Directory based users and Groups.
The current Snow Leopard Server serving files from a XSan volume is running fine, though we find a very long Lag time for Windows users to connect. Once a few users have connected the lag seems to go away, but it is still not nearly as fast as Mac users connecting or Windows connecting to a PC server.
So I have connected a second Xserve to the SAN and performed a clean install of Lion Server. Initially while it would find my Active Directory Groups it would not import any of the users, so obvioulsly no one could connect. In a last ditch effort I installed the beta of 10.7.4, which seemed to resolve the issue for a small group of test users. However as I expanded the test I found that some users would get a message that the were no resources available to them, or they didn't have the correct permissions. This is very strange as everyone is in the same group so should have the same permissions. As a test I took one of the user accounts and created a new share and gave him R/W permission to that share and suddenly all of the shares that he should have had permission to in the first place popped up.
The only thing that I can think of is that we have such a large Active Directory structure that the authentication is timing out or reaching some user limit and stops looking. (we have over 50,000 users and thousands of groups spread through multiple OUs in the AD structure)
The new Server.app in Lion looks nice, but it does not seem to have nearly the robustness of the previous Server Admin tools. For instance, I never needed or wanted to setup a "Golden Triangle" but with Lion it is required. Perviously I could search for AD users or groups and drag them from the search window to the share to assign permission, now even though I've imported the groups and users it needs to search the entire directory when assigning permissions - why can't it see the groups that are already there? Why can I run a dscl search and find a user or group instantly, but the Server.app hangs for 5 minutes and shows 0 results?
Has anyone found a way to make Lion Server work in an enterprise environment?

Yesterday morning I bound a 10.7.4 server to our AD, and in the afternoon I eventually saw all the AD users, groups, etc show in Workgroup Manager. Now, with dscl, I can see all the AD user and group records, and with Workgroup Manager, I can search the groups, users, and computers, but with the Server.app, when trying to create new group of the type "Imported group from another directory", the searches returned nothing. Directory Utility can show all the AD information also. Our AD has thousands of user record, and so it is reasonable that it may take some time for the Mac server to get all the info. But from the add users or groups interface, I just could not get any search results. What could be wrong then?

FCS 1.5 Not all Active Directory groups visible in list

Hi,
We just upgraded Final Cut Server to 1.5 and want to make use of Active Directory groups to set permissions in FCS. I've created a few groups in AD which do not appear in the list when I want to add these to Group Permissions. I do see many AD groups but some are not in the list. I can find the group in the Directory application and also with dscl (dscl /Active Directory/domain.tld -read /Groups/fcs-editor).
Please advice.
Thanks in advance,
Martin

I found a solution, though it might be still temporary. See if you can narrow down your Directory Search Policy. In your AD forest, you might need just one domain for your department, location, etc.
So, in Directory Utility, click on Search Policy, delete "/Active Directory/All Domains", don't apply yet, but click on the plus sign, and see what specific domains you can choose from there. Do the same to contacts.
Though still I can see now 1.592 records of groups or users when I run dscl but at least I know that AD administrators can really clean up our groups listings ( some of those groups are not being used) , and try to keep the number under 2,000.
It has to be a way to increase the default number of 2,000 in Search Policy, but I haven't had time to do that

After Active Directory System Discovery, some computers have Operating_System_Name_and0 as only the version number

Good morning,
We've been experiencing some odd behavior with discovery. After Active Directory System Discovery, some computers have Operating_System_Name_and0 as only the version number; for example, " 6.1" (note the space before the 6) vs.
"Microsoft Windows NT Workstation 6.1" (although, not limited to Windows 7 workstations).
Here are two seemingly identical machine records in Active Directory WCBWIN7VDI10 and WCBWIN7VDI11.
After discovery
select Name0, Operating_System_Name_and0 from v_r_system where Name0 LIKE 'WCBWIN7VDI1[0,1]'
yields
Name0 Operating_System_Name_and0
WCBWIN7VDI10 6.1
WCBWIN7VDI11 Microsoft Windows NT Workstation 6.1
For discovery on a new domain yesterday we have the following distribution:
select count (*) as [count], convert (nvarchar, Creation_Date0, 110) as [creation date], Operating_System_Name_and0
from v_r_system where Full_Domain_Name0 like 'aaa.bbb.ccc'
group by Operating_System_Name_and0, convert (nvarchar, Creation_Date0, 110)
order by Operating_System_Name_and0
count
creation date
Operating_System_Name_and0
274
12-01-2014
3
12-01-2014
5.0
23
12-01-2014
5.1
124
12-01-2014
5.2
20
12-01-2014
6.0
5109
12-01-2014
6.1
6
12-01-2014
6.2
4
12-01-2014
6.3
1
12-01-2014
CentOS 6.0
13
12-01-2014
Microsoft Windows NT Server
54
12-01-2014
Microsoft Windows NT Server 5.2
9
12-01-2014
Microsoft Windows NT Server 6.0
120
12-01-2014
Microsoft Windows NT Server 6.1
2
12-01-2014
Microsoft Windows NT Server 6.2
7
12-01-2014
Microsoft Windows NT Server 6.3
6
12-01-2014
Microsoft Windows NT Workstation 5.1
3501
12-01-2014
Microsoft Windows NT Workstation 6.1
1
12-02-2014
Microsoft Windows NT Workstation 6.1
5
12-01-2014
Microsoft Windows NT Workstation 6.2
1
12-01-2014
Microsoft Windows NT Workstation 6.3
2
12-01-2014
SLES 11
6
12-01-2014
Windows Embedded Standard 6.1
Anybody know why this occurs? We typically build our server vs. workstation collections with this.
Thanks,
Terence Durning

Hi Terence,
What is the value in Active Directory for the computer account?
Do you have the same behavior if you run this query?
SELECT DISTINCT Operating_System_Name_and0 FROM v_R_System ORDER BY 1
You are talking about a space before 6.1. Do I see also a space for all Microsoft Windows like "Microsoft Windows NT Workstation 6.3" ?
Nick Pilon - Blog: System Center Dudes

Cannot Retrieve Active Directory Groups

Hi All
I recently connected my ACS deployment to Active Directory 2003. However when I try to add the active directory groups for group mapping, i.e. navigating to Users and Identity Stores > External Identity Stores > Active Directory > Directory Groups Tab and click select.
My GUI on IE just loops and does not display anything(it does not freeze). On Firefox I receive "The connection was reset" error.
Any ideas?
Thanks in Advance

Do you have the proper AD permissions set for the AD account used to join ACS to the domain?
Note: AD account required for domain access in ACS should have either of these:
Add workstations to domain user right in corresponding domain.
Create Computer Objects or Delete Computer Objects permission on corresponding computers container where ACS machine's account is created before joining ACS machine to the domain.
Thank you for rating helpful posts!

Excluding some computers from Active Directory System Discovery

Hi,
I am trying to exclude some computers from Active Directory System Discovery. I created a new Organizational Unit for those excluded computers and that OU is NOT under the OU that I am discovering in the OU hierarchy. I specified the location
to be discovered under the Active Directory System Discovery properties. However, it is still discovering the computers that I wanna exclude from the discovery. I deleted those computers from console manually and run the discovery again, it still
discovers them.
What I might be doing wrong?
Thanks
Yavuz Selim Atmaca

Hi,
If you check under properties on the object, you can see which discovery agent is discovering the reasource, it could be the Group Discovery as well. That is where I would start to troubleshoot it.
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

Exclude servers from Active Directory System Discovery

We would like to exclude all servers from being discovered by Active Directory System Discovery. Is there any way to achieve this, i. e. with a custom LDAP query? Or does SCCM always detect all systems in the configured OUs? (Moving all servers to a separate
OU is not an option.)

Well, good question ;) ... We don't use SCCM on servers, and the basic reason was excluding them from statistics. Of course we want to prevent accidental client installation, but that can be done in other ways (like mentioned by Eswar).
Still, we always get tons of "computers without client", low success rates etc. Of course all that can be adjusted, excluding servers from "All Systems" etc., but excluding the servers directly from discovery would be the easiest way. If it can't be done,
it can't be done, and we will be able to live with that. I just wanted to know IF it can be done.
Well.If that is the issue with reporting,then you may have to edit the report to avoid servers in displaying in reports ,so will be on right track with results.
Or while creating collections to exclude certain number of computers or may be more,create a AD sec group and all the computers to it .Create collection to exclude computers which are member of this AD group to aviod accidentals installation...
Please click on "vote as Helpful" if you feel this post helpful to you.
Eswar Koneti | Configmgr blog:
www.eskonr.com | Linkedin: Eswar Koneti

BO XI 3.1 : Active Directory Authentication failed to get the Active Directory groups

Dear all
        In our environment, there are 2 domain (domain A and B); it works well all the time. Today, all the user belong to domain A are not logi n; for user in domain B, all of them can log in but BO server response is very slowly. and there is error message popup when opening Webi report for domain B user. Below are the error message:
       " Active Directory Authentication failed to get the Active Directory groups for the account with ID:XXXX; pls make sure this account is valid and belongs to an accessible domain"
      Anyone has encountered similar issue?
   BO version: BO XI 3.1 SP5
   Authenticate: Windows AD
Thanks and Regards

Please get in touch with your AD team and verify if there are any changes applied to the domain controller and there are no network issues.
Also since this is a multi domain, make sure you have 2 way transitive forest trust as mentioned in SAP Note : 1323391 and FQDN for Directory servers are maintained in registry as per 1199995
http://service.sap.com/sap/support/notes/1323391
http://service.sap.com/sap/support/notes/1199995
-Ambarish-

SharePoint 2013 Workflow (SPD 2013) fails for Active Directory Group members

Hi
I have a SharePoint 2013 site called "Team Meetings". There are a number of lists and an InfoPath form library.
The site's SharePoint Group "Team Meeting Members" has two Active Directory groups (All Club Managers and All Club Police) as members. Those two AD groups contain all the people that I want to have access to the library and list, except for
a few additional folk who I have made individual members.
My PROBLEM:
I have created a SharePoint 2013 Workflow using SPD 2013 associated with the Form Library. Workflow is set to start on new or modified item. The first action is to write to history list, then determine the status (Submitted or Pending) of
the form and go to different Stages depending on that status.
The workflow works perfectly for any user who has been added directly to the SharePoint group (Team Meetings Members) BUT FAILS at the very first action for anyone who is a member of one of the AD groups. I know the Workflow is fine because I've tested it
with numerous people who are direct members of the SharePoint Group, but whenever a person who is a member of the AD group tries it the Workflow just fails.
Here's a print of the info from the Workflow Status page (I don't have access to server logs):
RequestorId: 4494760f-92ff-2e8c-90d2-cc7df0e6baa4. Details: System.ApplicationException: HTTP 401 {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPRequestGuid":["4494760f-92ff-2e8c-90d2-cc7df0e6baa4"],"request-id":["4494760f-92ff-2e8c-90d2-cc7df0e6baa4"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4420"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1;
RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Mon, 10 Mar 2014 01:31:42 GMT"],"Server":["Microsoft-IIS\/8.0"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]}
The HTTP response content could not be read. 'Error while copying content to a stream.'. at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance
instance, ActivityExecutor executor, BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor
Members of the SharePoint Group "Team Meetings Members" have Contribute Access to both the form library and another list that the workflow writes to as well as the Workflow History list (which in SP 2013 uses the credentials of the
user who started the workflow, unlike 2010 which used System Account).
All members of the Team Meetings Members group, whether they are individual members or part of one of the AD groups, have no problems opening and saving forms etc. It's just the Workflow that doesn't like them...
I am stumped. I've spent many hours searching for a reason for this. There are about 200 people in the two AD groups so I really don't want to have to add them all individually - especially when these groups are managed in AD for a whole bunch of other reasons
and using the AD groups means I'll basically never have to worry about modifying the SharePoint access permissions.
Does anyone have any ideas why this is happening and what I can try to fix it?
Mark

Hi Lars,
I'm afraid not so far but we are trying a few things today so I will post back with results.
First thing we are doing is making the AD Group universal because one of our (external provider) gurus remembers seeing something about that. He also sent me a link to a post where they were talking about earlier
versions but having similar issues and their solution was to make sure the app pool account has sufficient permissions in AD::
http://social.msdn.microsoft.com/Forums/sharepoint/en-US/27a547da-5cc0-49d7-8056-6eb40b4c3242/failed-to-start-workflow-access-is-denied-exception-from-hresult-0x80070005-eaccessdenied
This part of that thread looks interesting but we haven't checked it yet as were trying the universal setting first:
"If the users participating in the workflows have been added to the SharePoint site via Active Directory groups, SharePoint has to update the user’s security token periodically by connecting to
the domain controller. By default, the token times out every 24 hours. But if the application pool account did not have the right permissions on the domain controller to update the user’s token, user will keep getting the access denied error. The error was
intermittent because when the user browsed to any page other than the workflow form, the token was getting updated successfully.
You can try to fix it through granting the application pool account the appropriate permission by adding the account to the group “Windows Authorization Access Group” in Active Directory."
I'll update when we try these ideas. If you have any luck please do the same.
Mark
(sorry about formatting - using my phone....)
Mark

Error in Active Directory System Discovery (0x80005010)

Hi,
I've configured Active Directory System Discovery in a SCCM 2007 R2 SP2 configuration. I see several SCCM clients being populated with OU information, but others do not. I've taken a look in the adsysdis.log. There it states for a very large number of computer accounts:
INFO: discovered object with ADsPath = 'LDAP://<domain controller>/<DN computerobject>'
WARN: Could not get property (domain) for system (0x80005010)
Afterwards there is no entry that states a ddr is written for this computer object and the SCCM client object is not populated with information.
Can someone explain what exactly is the issue, and how to solve it?

I got exactly same issue - SCCM 2007 SP2 two primary sites (one central). AD sctructure got one forest and two domains.
Does anyone solved this issue ?
adsysdis.log :
Starting the data discovery. SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: Processing search path: 'LDAP://CN=COMPUTERS,DC=MY,DC=DOMAIN'. SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: Full synchronization requested SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: DC DNS name = 'dc01.my.domain' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: search filter = '(&(objectClass=user)(objectCategory=computer))' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: ads path = 'LDAP://dc01.my.domain/CN=COMPUTERS,DC=MY,DC=DOMAIN' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: Bound to 'LDAP://dc01.my.domain/CN=COMPUTERS,DC=MY,DC=DOMAIN' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: discovered object with ADsPath = 'LDAP://dc01.my.domain/CN=TEST1,CN=Computers,DC=MY,DC=DOMAIN' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (domain) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: discovered object with ADsPath = 'LDAP://dc01.my.domain/CN=COMP2,CN=Computers,DC=MY,DC=DOMAIN' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (domain) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: discovered object with ADsPath = 'LDAP://dc01.my.domain/CN=SRV2,CN=Computers,DC=MY,DC=DOMAIN' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (domain) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
INFO: discovered object with ADsPath = 'LDAP://dc01.my.domain/CN=SRV3,CN=Computers,DC=MY,DC=DOMAIN' SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (operatingSystem) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (operatingSystemVersion) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (domain) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: Could not get property (dNSHostName) for system (0x80005010) SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
ERROR: System SRV3 is a unsupported operating system, unsupported version, or malformed AD entry. Reported system type is: (). SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)
WARN: CADSource::ProcessSystemInfo: Failed to get IP Address for the system. SMS_AD_SYSTEM_DISCOVERY_AGENT 19.11.2009 17:11:15 5360 (0x14F0)

Syncing Active Directory Groups for Unity Distribution Groups

We have multiple remote stores with managers that move around quite a bit. This poses an administration nightmare when trying to keep voicemail distribution lists up to date. Is there a way to syncronize an active directory group to a Unity voicemail distribution group? Therefore when we move a manager around in ADS the user automatically moves in Unity.

Unfortunately this feature has not been re-implemented in Unity Connection. This is one of the few things from Unity that I miss. I suggest voicing your desire for this as a feature enhancement with your Cisco AM.
If you are doing that many changes you may want to consider going through the Cisco Unity Connection Provisioning Interface. At least you could script the changes there using code that checked AD group membership and replicated the changes into CUC.

Add a mac to an active directory group using a script?

I am managing a bunch of Macs and we are using Active Directory groups to assign certificates for 802.11x. I am binding the device to AD using JAMF software and was wondering if I could use a script to then add the deive to an active directory group.
Thanks in advance...

I think I misunderstood your question. If you are trying to add the computer record to a location other than the Computers container, then just change your binding script to target the folder you want. Remember that the user account you are using to bind must have access rights to this folder.
For example, the sample command from the man page shows you how. Say you have a subfolder inside Computers called Macs. You would do this in your binding script. Note the notation of an organizational unit within the Computers container.
dsconfigad -a ThisComputer -u "administrator"
- ou "CN=Computers,OU=Macs,DC=ads,DC=demo,DC=com" -domain domain.ads.apple.com
Is that what you are looking to do?

Active Directory Mobile Account not working

Hello all. I've successfully joined a few macs to an Active Directory domain. However, I have a laptop that needs to be able to authenticate even when away from the network. The "Create Mobile Account" checkbox seems perfect for the job. From my reading, it seems that it is supposed to cache login authentication info from network login users. Then when the computer doesn't have a network connection, it uses the cached credentials. Upon 1st login it asks if I want to create a mobile account, and I say yes. However, it doesn't work accross a reboot.
If I reboot the computer without an network connection, and then try to authenticate at the login screen with my network user, the password field "shakes" as if I got it wrong.
However, I know it is sorta working because if I type >console into the user field, I get dumped to the console, where I can successfully login using the network user's credentials. Even without a network connection. But not from the gui login screen.
Any ideas?
Thanks!

Abbas,
You can find active directory synchronization option under PWA settings >> Operation Policies
1.In Project Web App, click the Settings icon, and then click Project Web App Settings.
2.On the Project Web App Server Settings page, in the Operational Policies section, click Active Directory Resource Pool Synchronization
3. On this page, you need to enter the Active directory Group which contains the users you want to sync and then click on save and synchronize.
You can check the status of the Enterprise Resource Pool synchronization by returning to the Active Directory Enterprise Resource Pool Synchronization page and reviewing the information in the
Synchronization Status section. It contains information such as when the last successful synchronization occurred. If last synchronization failed for any reason, it will also post a timestamp of when it occurred if you wanted to search
for more information in the ULS logs.
Let us know the results.
You can find more information on AD sync at
http://technet.microsoft.com/en-us/library/gg982985(v=office.15).aspx
Thank you,
Kiran K.

Active Directory Group Discovery not picking up Workstation OSs

Similar Messages

Maybe you are looking for