-
제목
ODM AD DirSync is not reading users during the Read workflow -
설명
ODM AD dirsync is not reading users during the Read workflow. Groups and machine accounts are read just fine. Workflow log shows timeout errors attempting to read user objects from AD. -
원인
Password options are enabled and DC is blocked by security software (like antivirus) from access by ODM AD dirsync agent -
해결 방안
To verify if antivirus on DC is a culprit, please disable all password-related options in the environment, Settings, Passwords for the affected environment. Then perform workflow with Read in it. User objects will be read successfully.
To resolve the issue, please troubleshoot connectivity issues between dirsync agent and domain DCs. Specifically ones, that are listed in the environment, Settings, Domain Controllers list.
Dirsync agent should be able to:
- open <DC_name>\ADMIN$ share using service account's credentials
- able to create BTpass folders there
- populate it with BTpass binaries
Additionally, this folder and all subfolders must be excluded from AV scanning/monitoring
Lastly, please make sure that LSA protection is not enforced either within the OS itself, or through UEFI boot option of DC machine.