I'm looking for details about how the BES Client determines Console Operators via AD Groups

Usage and Config Platform
1

BigFix v9.5.5

We are suffering from occasional problems where Console Operators will “lose control” of managed systems.

Consider this Example:
Role : Workstations
AD Group : WorkstationOps
BigFix Group : WorkstationComputers

Computers join the “WorkstationComputers” group based on Relevance. Assume there are 5000 computers in this group.

AD Users are added to the “WorkstationOps” AD Group. Assume that there are 5 members of this group.

The Role “Workstations” associates “WorkstationOps” with “WorkstationComputers”.

All 5 Console Operators can launch their Consoles and manage all 5000 computers. No problems.

Suddenly, 3 of the Console Operators are no longer seeing all 5000 of their computers. They see 250 computers in their Consoles. The other two Console Operators can still see and manage all 5000 computers.

Looking at the Roles as a Master Operator shows that 2 of the Operators in the Role are managing 5000 computers (normal mix of online and offline). 3 of them show that they are managing 250, mostly offline computers. All 5 Console Operators are members of the same Role, using the same Active Directory group. But only 2 are able to actively manage their computers.

It appears that the computers have simply decided to stop trusting 3 of the Console Operators.

To resolve the issue, I have to remove the 3 users from the “WorkstationOps” AD group, send a blank action to all the computers in the “WorkstationComputers” group. Wait for the 3 Console Operators to no longer show as being members of the Role, then add them back to the AD group and repeat the Blank Action.

My questions …

  1. Why are only 3 of the Console Operators losing control of their computers?
  2. What process do Endpoints use to determine who their Console Operators are?
  3. Which system is actually querying Active Directory and not getting the correct information?
  4. Why don’t the computers eventually discover on their own that they are supposed to trust all 5 Console Operators?
2

The clients use management rights actions within the master actionsite to determine if a console operator has control over them. These actions use simple relevance to determine if the operator is valid on the endpoint so you should be able to look at the relevance to determine what is happening. Remember AD membership is slower to update for some items on the endpoint.

3

So what would cause endpoints to decide that they were going to no longer trust a Console Operator even through they are in the AD group for the Role?

And why would removing the user, triggering a blank action, then adding the user back in again resolve the issue?

1 Like