-
Title
How can I index the service attributes that are used during the Active Directory Synchronization -
Description
CPU usage on the DC when migrations are running is high and Linkresolver.log contains warnings similar to the following:
6-1-2012 12:46:07 3896 2264 Warning: matching attribute extensionAttribute15 of class user is not indexed. Links resolving performance will be significantly reduced.
6-1-2012 12:46:11 3896 2264 Warning: matching attribute extensionAttribute15 of class group is not indexed. Links resolving performance will be significantly reduced.
6-1-2012 12:46:13 3896 2264 Warning: matching attribute extensionAttribute15 of class contact is not indexed. Links resolving performance will be significantly reduced.
6-1-2012 12:46:15 3896 2264 Warning: matching attribute extensionAttribute15 of class inetOrgPerson is not indexed. Links resolving performance will be significantly reduced.
6-1-2012 12:46:19 3896 2264 Warning: matching attribute extensionAttribute15 of class computer is not indexed. Links resolving performance will be significantly reduced.
Quest Migration Manager Best Practices advises to index the service attributes in the schema but it doesn't explain how to do this.
How can this be performed? How can I index an attribute? -
Resolution
Excerpt from the "Quest Migration Manager Best Practices":
When synchronizing objects, the Directory Synchronization Agent populates the objects' attributes specified as the service attributes in Migration Manager with matching and auxiliary information. It is recommended to index the service attributes in Active Directory to improve the Directory Synchronization Agent performance.
IMPORTANT: This recommendation applies to all matching attributes for all object classes listed under Domain Pair Properties - Object Matching - Service Attributes. By default they are extensionAttribute 15 and adminDisplayName. For more information on how to improve DSA performance please refer to the Quest KB 25460.
In this example the steps below are for indexing "ExtensionAttribute15":
1. Log into a domain controller under and administrator account that is a member of the schema Admins group.
2. Open a command window and type the following command:
Regsvr32 schmmgmt.dll
3. Open an MMC console and add the Active Directory Schema snap-in.
4. Expand Active Directory Schema.
5. Select Attributes and navigate to extensionattribute15.
6. Right-click on extensionattribute15 and select Properties.
7. Check the box entitled Index this attribute in the Active Directory and click OK.
8. Close the Schema Admin MMC.
Microsoft has a Technet article how to index an attribute:
http://technet2.microsoft.com/WindowsServer/en/Library/44cb16a2-7969-4e59-8c9b-5962604ff1fb1033.mspx?mfr=true
This Technet article tells us the following:
To index an attribute in Active Directory
1. Open the Active Directory Schema snap-in.
2. In the console tree, click Attributes. Where?
Active Directory Schema/Attributes
3. In the details pane, right-click the attribute that you want to index, and then click Properties.
4. Click Index this attribute in the Active Directory.
Notes:
1. To perform this procedure, you must be a member of the Schema Admins group in Active Directory, or you must have been delegated the appropriate authority.
As a security best practice, consider using Run as to perform this procedure.
2. The Active Directory Schema snap-in must be connected to the schema master to perform this procedure. The Active Directory Schema snap-in connects to the schema master by default when it is started.
3. If the Active Directory Schema snap-in is not installed, see Other Resources.
4. Indexing an attribute improves the performance of queries run against the attribute.
5. In a two way synchronization it is advisable to index the attributes for both the target and source domains.