---
title: AD cache Status Incorrect After Moving Users Outside Activate
slug: ad-cache-status-incorrect-after-moving-users-outside-activate
docTags: 
createdAt: 2026-01-27T22:18:54.116Z
---

This document explains why ADCache status can become incorrect when user objects are moved outside of Activate, and how to ensure ADCache remains aligned with Active Directory.

# Overview

ADCache reflects the last known state of objects as synchronised by Activate. When user or object changes are made directly in Active Directory, outside of Activate-managed processes, ADCache may become inaccurate if the relevant objects are not included in a scheduled role synchronisation.

# Cause

Role synchronisation is typically run on a scheduled basis, commonly nightly. If a user is moved to a different organisational unit or otherwise modified outside of Activate, and the role responsible for syncing that user does not include the new location, the ADCache entry for that user will not be updated.

This most commonly occurs when only a limited role (for example, a specific business unit or department) is included in the nightly synchronisation, rather than the full domain scope.

# Resolution

To maintain ADCache accuracy for all users, ensure that a role covering the entire domain is included in a scheduled background task.

A common approach is to use the built-in system role that represents the entire domain and include it in an existing nightly process, such as licence statistics or another background task.

# Implementation Example

The following example demonstrates how the entire domain role can be explicitly synchronised as part of a background task:

:::BlockQuote
Role entireDomain = ProvisioningSystem.Organisation.Roles\["System Roles/Entire Domain"] as Role;
if (entireDomain != null)
\{
    entireDomain.SyncADMembers(
        Role.SyncFlags.ChangesOnly |
        Role.SyncFlags.ExistingUsers |
        Role.SyncFlags.LogResults
    );

    LogTrace("System Roles/EntireDomain sync Complete: {TIME}");
}
:::

# Operational Notes

Ensure that:

- The entire domain role is included in a regularly scheduled background task
- Synchronisation runs at a frequency appropriate for your environment
- Logging is enabled to confirm successful execution and to assist with troubleshooting

Regular full-domain synchronisation helps prevent discrepancies between Active Directory and ADCache when changes occur outside of Activate.