How to Change the DC that AD Compliance uses
Background
Security Group Compliance Manager requires a default Domain Controller (DC) to communicate with when it is first initialized. This is necessary because the DirSync component that is used by Activate to obtain all AD changes requires that the same DC be used for each query.
It is sometimes necessary to change the DC that is being used. This document outlines the process for doing this.
Process
This process requires a complete resync of the Active Directory Domain into Activate and therefore should be complete after hours when Activate is not in use. Depending upon the size of the domain the process may take a few minutes to a few hours.
1. Stop the Activate Orchestrator
This is required to stop Activate polling Active Directory during the resync process.
2. Ensure that all pending Active Directory Compliance Changes have been processed.
A. Open Activate Studio B. Goto //Resources/ActiveDirectory C. Right click and select Connector Tasks->Show Data D. Process or commit all pending changes
3. Change the Domain controller
A. Select the appropriate sub-domain under //Resources/ActiveDirectory B. Change the Connector_ADServer parameter to the fully qualified domain name of the new DC. Note - This must be a fixed DC and cannot be a DNS alias. C. Delete the Connector_DirSyncCookie - This is very important as this cookie is specific the DC above which has not changed.
4. Resync the domain Note: This may take a few minutes to a few hours depending upon the size of the domain. This process will reimport ALL AD objects and regenerate a new Connector_DirSyncCookie.
This process must be run as a Domain Administrator as this process requires DirSync rights. Ideally this process should be run as the Activate Service Account.
A. Right click on //Resources/ActiveDirectory and select Connector Tasks->Run Workflow->Import Workflow B. Wait for the Resync to complete. 5. Check results A. Open Activate Studio B. Go to //Resourecs/ActiveDirectory C. Right click and select Connector Tasks->Show Data D. Check that the pending changes are ok. If so leave them to process or commit them so they are not processed.
6. Restart Activate Job Service The normal polling and synchonization process can now continue.