Computer Remains in Active Directory Filter After Being Removed from AD Security Group

Products

• IT Management Suite
• Client Management Suite
• Server Management Suite

Issue/Introduction

When a computer resource is removed from an Active Directory (AD) Security Group, subsequent AD import rule updates may fail to remove the computer from the corresponding automatically created organizational unit or security group filter in the Symantec Management Platform (SMP) Console.

Environment

IT Management Suite (ITMS)

AD Import

ITMS 8.8.1 (including 8.8.1 PF v3 through v6)

Fixed In: ITMS 8.8.1 PointFix v7 and later, ITMS 8.8.2

 

Cause

During an AD Import run, the SMP Server (Symantec Management Platform or Notification Server (NS)) evaluates membership changes. If an endpoint is removed from a group, the import process unlinks the resource from the import rule in Inv_Import_Rule_Imported_Items. However, if the generated Notification Server Event (NSE) containing updated membership details fails to process on the SMP Server (e.g., due to SQL timeouts or processing failures), the resource remains unlinked while the dataclass table (Inv_Security_Groups) continues to store stale group membership data. As a result, the AD filter retains the deleted computer because the rule no longer manages or cleans up its unlinked membership record.

The issue is caused by a race condition or failure during NSE processing during AD group membership updates:

1. Unlink without Dataclass Update: The AD import logic unlinks the computer resource from Inv_Import_Rule_Imported_Items upon detecting its removal from the group. If the generated NSE carrying updated membership fails to process in SQL, the database table Inv_Security_Groups retains the old membership record. Because the resource is already unlinked from the rule, subsequent import updates ignore updating its stale group membership.
2. Multiple Import Rules Overlap: If multiple rules import from the same AD security group or OU, updating one rule does not purge stale records created or maintained by another rule.
3. Unmanaged Filter Prefix: Filters that are no longer actively managed by an active AD import rule may display an [X] prefix, indicating their membership is locked and no longer maintained.

Resolution

This has been fixed with our ITMS 8.8.2 release.
  

Diagnostics & Investigation

To confirm whether the target computer is affected by orphaned or stale membership records, execute the following SQL queries in SQL Server Management Studio (SSMS) against the Symantec_CMDB database:

-- 1. Check if the computer is linked to any active AD Import Rule
SELECT DISTINCT vc.Name as [ComputerName], edis.ImportRuleGuid, vi.Name as [RuleName] 
FROM vComputer vc
INNER JOIN Evt_Directory_Import_Status edis ON edis._ResourceGuid = vc.Guid
LEFT JOIN vItem vi ON vi.Guid = edis.ImportRuleGuid
WHERE vc.Name = 'YOUR_COMPUTER_NAME';

-- 2. Inspect current security group dataclass entries
SELECT * FROM Inv_Security_Groups WHERE _ResourceGuid = 'YOUR_COMPUTER_GUID';

-- 3. Check rule binding status
SELECT * FROM Inv_Import_Rule_Imported_Items WHERE _ResourceGuid = 'YOUR_COMPUTER_GUID';

-- 4. Check active directory import rule tree configuration
SELECT * FROM DirectoryImportRuleTree t 
WHERE t.ImportRuleGuid = 'YOUR_RULE_GUID' 
  AND t.[Distinguished Name] = 'DN_OF_SECURITY_GROUP_IN_UPPERCASE';

-- 5. Test directory rule security group membership logic
EXECUTE spDirectoryRuleReadSecurityGroupsMembers 
    @guidResourceType='493435f7-3b17-4c4c-b07f-c23e7ab7781f', 
    @rule='YOUR_RULE_GUID';

Diagnostic Findings Summary

Diagnostic Step / Query	Expected Output	Actual Output (Issue Present)	Interpretation
Inv_Import_Rule_Imported_Items	Displays row linking computer GUID to import rule GUID.	Query returns 0 rows.	Computer was unlinked prematurely during the failed import cycle.
Inv_Security_Groups	Stale security group GUID is removed after import.	Stale security group GUID remains listed.	NSE processing failed to clean up the dataclass table.
Directory Filters Tree	Managed filter updates membership smoothly.	Filter name prepended with [X] or contains stale computer.	Filter is unmanaged or rule scope has changed.

 

Step-by-Step Remediation

1. On the SMP Server, navigate to Manage > Filters in the Symantec Management Platform (SMP) Console.

2. Verify if the target AD filter name contains the [X] prefix (e.g., [X] CN=1 ip security group - global...).

3. Download and apply ITMS 8.8.1 PointFix v7 (SMA_SMP_8_8_1_PF_v7 or later) or upgrade to ITMS 8.8.2. This update prevents resource unlinking from rules if membership cleanup fails.

4. After applying the PointFix or upgrade, run a Delta Update on the affected AD Import Rule:

   • Go to Actions > Import > Import Microsoft Active Directory 

   • Select the target AD import rule and click Run Delta Update.

Validation

1. Open the SMP Console and navigate to Manage > Filters > Notification Server Filters > Directory Filters.

2. Select the target Security Group filter.

3. Click Update membership and verify that the removed computer no longer appears under Filter Membership.