Profile Manager half populates groups

[Sheridan]

I'm not sure why I'm still bothering with this bug ridden mess, but I thought I had this working to a reasonable degree - users were getting profiles mapped on their AD group membership.

 

However today my users stopped getting profiles (well, some of them) . When I check the group membership in Profile Manager, some of the groups only show some of the members (and those are the one that get their profiles) but others are missing.

 

Oddly, in the Server app, the groups show their full AD membership, its just through the PM web interface that they are incomplete. They were OK last week but not any more!

 

Is PM really that flakey or have I missed out something here?

[free780]

Pm cant deal with large AD Groups. I found the mac server needs read access to the user objects to pick up all the attributes.

[Sheridan]

The server running PM can see everyone in the groups (in the server app anyway) and PM was reading the groups OK last week. It just reads partial membership now.

 

I know there a 1000 limit on ad searches, which I don't think is a good idea to change - I wonder if PM does one 'complete' search or a search by group (no group has more than about 250 members)