Filters created during Active Directory import from OU (Organizational Unit) are displayed with distinguished name instead of canonical name

Products

• IT Management Suite

Issue/Introduction

Since SMP 7.5, filters created during Active Directory import are shown in the UI with distinguished name (instead of canonical name in SMP 7.1).
As a result, targeting resources by filters is not convenient and tasks based on canonical name may fail.

No error in Altiris log viewer.

Cause

This behavior is associated to code changes implemented in the ITMS 7.5 release.

Resolution

This issue has been fixed partially in ITMS 7.5 SP1 HF4 and fully implemented in the ITMS 7.6 release.

The information below only applies to SMP 7.5 SP1 where in SMP 7.6 please use the new settings called "ADUseCanonicalNameForFilters", "ADUseCanonicalNameForSecurityGroups" and "ADUseCanonicalNameForDistributionGroups" in the coreSettings.config (under C:\ProgramData\Symantec\SMP\Settings):

<-- if set true, the AD import will create filters with canonical names -->
<customSetting key="ADUseCanonicalNameForFilters" type="local" value="0" />

When set to 0 (default value)	When set to 1

<!--This setting controls how windows security groups are shown in the selection dialog.
 If enabled the search results will display each groups reverse canonical name.
This is useful when dealing with Windows 2003 Native AD domains as security groups with duplicate names are allowed.-->

<customSetting key="ADUseCanonicalNameForSecurityGroups" type="local" value="true" />

 

<!--This setting controls how windows distribution groups are shown in the selection dialog.
If enabled the search results will display each groups reverse canonical name.
This is useful when dealing with Windows 2003 Native AD domains as distribution groups with duplicate names are allowed.-->

<customSetting key="ADUseCanonicalNameForDistributionGroups" type="local" value="true" />
 

For ITMS 7.5                                                                            

Note: After the release of ITMS 7.5 SP1 HF4, it was discovered that Security Groups were not implementing the changes done to the AD Filters displaying names. A pointfix for that version as well for HF5 has been created to address that. See the attached file "PointFix_eTrack3694117_7.5_SP1_HF4.zip" and "Pointfix_eTrack3702569_7_5_SP1_HF5.zip".

 

In order to apply this change in the folder display name, please do the following on your SMP server:

1. Go to C:\ProgramData\Symantec\SMP\Settings and open CoreSettings.config
2. Add <customSetting key="CreateOuFiltersWithCanonicalNames" type="local" value="true" /> entry in CoreSettings.config. Save changes.
3. Re-run your AD Import Rule(s) for the folders to be recreated.

 

 

A pointfix has been provided for those in ITMS 7.5 HF6. See attached "Pointfix_eTrack3596718_SMP_7_5_HF6.zip"
A pointfix has been provided for those in ITMS 7.5 SP1. See attached "Pointfix_eTrack3623995_SMP_7_5_SP1.zip"

APPLICABILTY  REQUIREMENT :

For pointfix for HF6 --> SMP 7.5 HF6 installed
For pointfix for 7.5 SP1 --> SMP 7.5 SP1 installed

For pointfix for 7.5 SP1 HF4 -->SMP 7.5 SP1 HF4 installed
For pointfix for 7.5 SP1 HF5 -->SMP 7.5 SP1 HF5 installed

 

HOW TO INSTALL THIS POINTFIX:

1. Extract files from the archive to the NS hard drive. Make sure Point Fix is not extracted to Altiris install directory (or any subfolder to it).
2. Execute PFInstaller.exe with administrative privileges (right-click > Run as administrator). Select "Install Files".
3. Accept UAC (User Account Control) if prompted, select Install Files. Old binaries will be automatically backuped to the Backup folder at the same location where PFinstaller is and replaced with the new ones. Log-file Log.txt will be created at the same location where PFinstaller is.
4. Close PFInstaller window.
5. Go to C:\ProgramData\Symantec\SMP\Settings and open CoreSettings.config
6. Add <customSetting key="CreateOuFiltersWithCanonicalNames" type="local" value="true" /> entry in CoreSettings.config. Save changes.
7. Re-run your AD Import Rule(s) for the folders to be recreated.

 

HOW TO UNINSTALL THIS POINTFIX:

1. Make sure that Backup subfolder is located in PFinstaller directory
2. Execute PFInstaller.exe with administrative privileges (right-click > Run as administrator). Old binaries will be repaired from Backup folder located at the same location where PFinstaller is. NS services should be started automatically.
3. Accept UAC (User Account Control) prompt, select Uninstall Files.
4. Close PFInstaller window.
5. Remove the setting added to the CoreSettings.config and Save the file.

CHANGES MADE :

1. Changes made Altiris.DirectoryServices.dll.

 

This hotfix has the following known issues:

None

 

 

Previous workaround:
As it is not possible to rename the imported filters (you will get permission error) following workaround cn be done dealing with few filters:

Workaround :
- clone filters that have been created during the AD import task
- rename them as needed
- call those renamed filters instead to target your machines 
 

 

 

<!--

 

Applies To

 

Symantec Management Platform 7.5 (HFx, SP1)