Active Directory users are not synchronized to VIDB

Products

• VCF Operations

Issue/Introduction

Existing and new users in Active Directory are not synchronized to VIDB during a manual or scheduled sync.

The sync appears to run successfully but no users or groups are imported.

The BIND account is a member of the standard 'Domain Users' group.

Environment

VCF Operations 9.1

Cause

The BIND account does not have the minimum required permissions in Active Directory.

Resolution

Configure the minimum required privileges by applying the following two configurations to the bind account (as per standard Microsoft best practice):

1. Delegate Read Access on the Base DN The bind account needs explicit read access to user and group objects within the Base DN(s) configured in vIDB.

• Open Active Directory Users and Computers.

• Right-click your configured Base DN OU(s) and select Delegate Control.

• Add the vIDB bind service account.

• Select Create a custom task to delegate.

• Select Only the following objects in the folder, and check both User objects and Group objects.

• Check Read All Properties (Ensure this applies recursively to all descendant objects).

2. Grant Access for Nested Group Sync
If, "Sync nested groups" is enabled, standard users cannot read the computed attributes required for nested group traversal.

• Add the vIDB bind account to the built-in Active Directory Windows Authorization Access Group. This is Microsoft's standard group for allowing service accounts to read nested group structures.