07 April 2008

AD imported computers not being removed by Directory Synchronization

Several old computers that no longer exist inside Active Directory are still showing up in the All Windows NT/2000/XP/2003/Vista without the Altiris agent installed collection even though the Discovery Synchronization Schedule is enabled. Resource Manager shows that both the OU Membership and the Global Active Directory Details data classes have been populated. These fields only exist if the computer was discovered by an AD import rule.
No errors are showing up in the Notification Server logs during the synchronization or during the imports.

Cause
The computer's guid is no longer listed in the Inv_Import_Rule_Imported_Items table that is used by the Directory Synchronization to determine which unmanaged computers need to be purged.
Resolution
The following SQL query will show which resources (Computer or Virtual Machine) no longer have entries in the Inv_Import_Rule_Imported_Items table, but have the OU Membership & Global Active Directory Details dataclasses.
SELECT vr.Name, rt.Name AS 'Resource Type', vr.guidFROM vResourceEx vrJOIN Inv_OU_Membership ou ON ou._ResourceGuid = vr.guidLEFT JOIN Inv_Import_Rule_Imported_Items ii ON ii._ResourceGuid = vr.guidJOIN ResourceType rt ON rt.guid = vr.ResourceTypeGuidWHERE vr.IsManaged = 0AND ii._ResourceGuid IS NULLAND vr.ResourceTypeGuid IN ('493435F7-3B17-4C4C-B07F-C23E7AB7781F', '2C3CB3BB-FEE9-48DF-804F-90856198B600')
This query can be used to create a report or collection.
To find out more information about which process (Purge Maintenance or Directory Synchronization) will be used to remove a computer from the Notification Server see article
34954