Active Directory Resync schedule does not remove unmanaged computers deleted from AD.

Products

• IT Management Suite

Issue/Introduction

Active Directory Resync schedule does not remove unmanaged computers deleted from AD.

Environment

8.x.

Cause

ITMS 8.1 RU4 and later, by default computers are deleted 7 days after removal from AD.
 

Resolution

When ‘Delete’ action is enabled, we check which affected resources have been imported by AD Import rules and only perform deletion to those which are older than the timespan defined by days in this setting: ADResyncDeleteResourcesThresholdDays. Computers are deleted immediately if this setting is set to 0.  The default is 7 days.

To delete computers immediately after resync please do the following:

1. Browse in the Console to Settings > Notification Server > Core Settings
   1. In ITMS 8.1 and earlier: Edit the "C:\ProgramData\Symantec\SMP\Settings\CoreSettings.config"
2. Search for ADResyncDeleteResourcesThresholdDays and set the value to "0" (days)
   
3. Make sure the AD import rules are Enabled (marked as green) and have a future schedule.
   
   Note:
   Put attention to the NS logs. Sometimes we can make the assumption that the "Directory Synchronization", or even the actual "Users AD Import Rule" Schedule for those Users/computers is turned on when it is not. (KB 193879 "ITMS 8.0 HF1 - What has changed in the Symantec Management Console, on the Microsoft Active Directory Import page?")
   If you see an entry like this in the NS logs when running "Directory Synchronization" (AD Sync) :
   "No directory import rules are scheduled, resync will not perform any actions.","DirectoryResyncItem::ResyncImportedResources","AeXSVC.exe","116","Informational",
   usually indicates that the AD Import Rule has a disabled schedule, please check it.
   ps. We've seen some times schedules were "off" after upgrades, so turn them "ON"
   
   
4. Enable the AD Sync by clicking on the Calendar Icons shown below, and schedule it to run:

The last step is to run the AD Sync schedule in the UI or "NS.Directory Resync Update Schedule Item" scheduled task (NOTE: Shared Schedules will not show up here) on the SMP Server.

If systems are still not deleting, we may need to run the SQL in KB: 151975