This document explains why ADCache status can become incorrect when user objects are moved outside of Activate, and how to ensure ADCache remains aligned with Active Directory.

ADCache reflects the last known state of objects as synchronised by Activate. When user or object changes are made directly in Active Directory, outside of Activate-managed processes, ADCache may become inaccurate if the relevant objects are not included in a scheduled role synchronisation.

Role synchronisation is typically run on a scheduled basis, commonly nightly. If a user is moved to a different organisational unit or otherwise modified outside of Activate, and the role responsible for syncing that user does not include the new location, the ADCache entry for that user will not be updated.

This most commonly occurs when only a limited role (for example, a specific business unit or department) is included in the nightly synchronisation, rather than the full domain scope.

To maintain ADCache accuracy for all users, ensure that a role covering the entire domain is included in a scheduled background task.

A common approach is to use the built-in system role that represents the entire domain and include it in an existing nightly process, such as licence statistics or another background task.

The following example demonstrates how the entire domain role can be explicitly synchronised as part of a background task:

Ensure that:

Regular full-domain synchronisation helps prevent discrepancies between Active Directory and ADCache when changes occur outside of Activate.