Security Group Compliance Manager
Activate Security Group Compliance Manager (SGCM) is built on the Activate Connector framework and provides continuous detection, classification, and response to Active Directory (AD) changes. This document outlines the key architectural components and concepts that underpin SGCM operations.
Architecture Overview
SGCM operates as a background monitoring and enforcement service that synchronises Active Directory data into the Activate platform using the AD DirSync control. Changes are processed through connector workflows that detect events such as object creation, modification, or group membership updates.
The architecture is composed of three primary layers:
- Detection Layer – Uses DirSync to identify AD changes in near real time.
- Connector Layer – Stores detected changes in the Activate Connector Space for evaluation.
- Workflow Layer – Executes policy-based actions (notifications, removals, job submissions) in response to events.
Detecting Active Directory Changes
SGCM uses Microsoft’s DirSync control (a Lightweight Directory Access Protocol, or LDAP, extension) to detect any new, modified, or deleted objects within AD. Each synchronisation cycle compares known Activate-managed changes with those detected directly in AD to identify external modifications.
Key Characteristics:
- Tracks users, groups, and computers across multiple domains.
- Includes deleted object detection.
- Uses a domain controller–specific DirSync cookie to maintain state between syncs.
When changing the domain controller, the existing DirSyncCookie parameter must be removed to force a full resynchronisation.
Connector Space
The Activate Connector Space provides a dedicated data model for tracking AD objects and their state. SGCM uses a single connector space per forest, storing object attributes and membership relationships for comparison and event generation.
Monitored Object Types:
- Users
- Computers
- Security Groups
- Distribution Lists
Change Events:
- Create – New object detected.
- Update – Attributes or membership changed.
- Delete – Object removed from AD.
Membership changes are handled separately from group or user modifications, allowing granular tracking of each add/remove operation.
Event Processing
Each detected change generates a corresponding event within Activate. Event types include:
- Create: New object or group membership added.
- Update: Object properties or relationships modified.
- Delete: Object removed or group membership deleted.
- Deny: Triggered when a change violates policy (for example, an unauthorised group addition).
Event handlers determine the appropriate workflow or response—such as rolling back an unauthorised membership, notifying group managers, or initiating a service removal.
Schema and Monitored Attributes
SGCM uses a standard Activate Connector schema that defines the columns tracked within the Connector Space. Typical attributes include:
Attribute | Description |
|---|---|
objectGUID | Unique identifier for each AD object |
objectClass | AD object type (user, group, computer) |
dn | Distinguished Name in AD |
displayName | Display name of the object |
samAccountName | AD logon name |
department | User’s department |
title | Job title |
member | Multi-valued attribute listing group members |
userAccountControl | AD control flags such as enabled/disabled |
adminDescription | Notes and administrative metadata |
Additional columns may be defined for extended compliance checks, provided the Connector schema size matches or exceeds the AD schema.
Permissions
SGCM synchronisation must run under a service account with the Replicate Directory Changes permission on the monitored domain. This permission can be delegated to a non-administrative account if required.
Refer to Microsoft KB article 303972 – How to Grant the “Replicating Directory Changes” Permission for detailed steps.
Workflow Integration
SGCM workflows define what happens when a change event occurs. Workflows can:
- Submit an Activate task for approval.
- Send notifications to role-based recipients.
- Remove users from restricted groups.
- Log compliance actions for audit.
Workflows are configured under //Resources/Active Directory and may include predefined templates such as:
- ImportWorkflow – Imports detected changes.
- ChangeWorkflow – Processes detected object changes.
- GroupMemberWorkflow – Handles membership-specific events.
- FullWorkflowWithGroups – Combines all stages for continuous polling.
Background Polling
SGCM runs as part of the Activate Job Service. A background thread polls AD on a scheduled interval, executing a defined polling workflow. Parameters controlling this behaviour include:
Parameter | Description | Default |
|---|---|---|
Connector_PollTime | Interval between directory checks (seconds) | 600 |
PollWorkflow | Name of the workflow executed during polling | None |
Integration with Other Products
- Activate Identity Manager – Provides user lifecycle data and role mappings for AD synchronisation.
- Activate Privileged Access Management (PAM) – Aligns privileged group membership monitoring with just-in-time access policies.
Summary
The Security Group Compliance Manager architecture combines real-time detection with automated remediation to enforce AD integrity. Through its integration with Activate’s Connector framework and workflow engine, SGCM provides a unified, policy-driven approach to directory compliance across hybrid environments.