Active Directory Group Members Not Populating In BigFix Automatic Computer Group

Content Authoring
1

I have created a group in our domain to place computers in entitled “AD-BIGFIXTEST”. I then added a few active computers that I knew also appeared in BigFix. I then set up an automatic group in Bigfix with the following relevance as true:

(version of client >= “6.0.0.0”) AND (exists true whose (if true then (( ((exists value whose(it as lowercase = “AD-BIGFIXTEST” as lowercase ) of components whose(type of it=“CN”) of distinguished names ((distinguished names of groups of it; distinguished names of it) of local computer of it))) of active directory)) else false))

Even after sending a refresh to the endpoints I am not seeing any show up in the group. Did I go wrong somewhere here? It’s worth mentioning I am sure we have a stable LDAP connection as nearly all login accounts use LDAP authentication.

Thanks,
Matt Johnson

2

The AD information doesn’t update immediately so make sure you take time into account.

By default computer information only updates once every 12 hours and user information updates only at login.

1 Like
3

Thank you. That makes sense. Is there any way to force replication (e.g. A Task to refresh AD group memberships)

4

Not really as doing so could put such a burden on your AD server that it collapses (think 100K or more endpoints suddenly asking for the information all at once)

5

There is a Client Setting that will adjust how frequently the BES Client polls your AD. As @alan mentions, you need to take care with this setting. The unit for the setting is SECONDS, and be sure to not make your clients refresh more frequently than once every 3-4 hours. You could adversely impact both your AD Domain Controllers as well as your BES Client performance.

The setting you are interested in is …
_BESClient_Inspector_ActiveDirectory_Refresh_Seconds

You can read about this and other settings HERE.

6

As an additional mention that setting only controls the computer time, not the user time. I’m wondering why that page is so outdated

1 Like
7

@AlanM
What do you mean Computer Time vs User Time?

8

The Active Directory Computer information (For the computer object) updates at the interval set by that client setting you mentioned.

The Active Directory User information (For the logged on user) updates when the user logs in.

It looks like this in the client log:

At 15:10:28 -0500 -
User interface process started for user ‘strawgate’
At 15:10:39 -0500 -
ActiveDirectory: User logged in - Domain: AD User: strawgate
ActiveDirectory: Refreshed User Information - Domain: AD User: strawgate

1 Like
9

It is annoying that it is outdated, and as far as I know it is the most complete set of Client Settings documentation that is available.

10

Thank you all for your assistance! It it refreshes on login we should be okay. Except for those situations where the user is logging in via VPN and has not AD connection on local login.

Thanks again,
Matt Johnson

11

It should be possible to trigger a Group Policy Update upon VPN connection.

Here is an example that triggers a Symantec AV Definitions update on the managed client upon the connection of the old Cisco VPN: https://bigfix.me/fixlet/details/743

The same concept can be applied to anything that requires VPN access to function and can have an update triggered through the command line, as long as you can figure out some relevance to detect when the VPN connects.

Here is another example that triggered a backup agent to register with the server upon VPN connection: https://bigfix.me/fixlet/details/761

12

All,

Is there no way to get the automatic actions groups populated from the IBM servers itself, instead of waiting for the client to report back?
Why does the Bigfix server itself does not check with the AD security groups to see what members there are?

13

The root server doesn’t populate the automatic groups, it is the endpoint that determines if it belongs or not. Everything is endpoint based. You define the relevance on the root, it gets sent out to the endpoints, they evaluate it, then they report their status back to the root and then they show up.