SLG provisioning woes for some users

[Argh_iPads]

Hey all,

 

I'm having problems with provisioning some users in sims for SLG. It should be that after adding users in the provisioning section in sims, the ADP service creates SLG accounts in AD.

 

The ADP report from sims shows that it can see the users, but the username and password fields are blank, and the SLG accounts in AD are not being created. I have tried re-provisioning the problem users a number of times, but still the same issue.

 

The ADP service appears to be running fine, and I can find no problems with these user accounts in sims or AD.

 

What am i missing?

[bald_pig]

When we were using SLG we had to run a script on the server after provisioning in SIMS to create the accounts, have you done this?

[dapaulio]

Ok so you have provisioned the users within sims but the adp service hasn’t created the user ad yet. The sims report shows this by showing no username and password as you have described.

 

Firstly the adp service should be running as you have confirmed

 

Secondly the process is called by a batch script in task scheduler typically daily at a certain time. Has this task ran since you have provisioned the users?

 

Also is it running in the highest privileges .

 

These are the commons things to look for

[Argh_iPads]

The ADPSceduledProcess is set to run as a scheduled task, and it appears to be running fine. I have stopped this, and initiated ADP manually to see if there is any difference.

 

On the ADP web tool: http://localhost:1103/Default.aspx I can see that requests are being processed. But the problem users aren't in the list.

 

I have been going over these users in sims, and the data seems to be correct. I can't see anything that might be off.

[dapaulio]

Do the users appear in AD?

[Argh_iPads]

So staff and students already have AD accounts. SLG creates accounts for these users which are consolidated, and the parents accounts are created.

 

So when we search for a student, we should find two accounts, which in most cases we are, but with the problem users, we are only seeing their existing account. So SLG is not creating accounts for these.

[dapaulio]

Ok yes I understand. Your adp service is not doing what it is supposed to be doing.

save this code as a bat or cmd file on your desktop and run as administrator

Report back the status of service.

if it may hangs for up to 10-15 mins and fail, try running it again. this sometimes happens to me but returns successful the second time.

 

 @echo off
:RUN
cls
c:
cd \program files (x86)\sims\adpclient\changetracking\
adpscheduledprocesses.exe

pause

 

also look in the event log on the adp server for a log called ADProvisioning. it is under the folder "application and service logs"

[Argh_iPads]

The log looks good, the provisioning service appears to be running OK....

 

[dapaulio]

I’m going to assume the server instance that you redacted matches the sims server and sims database instance?

 

If correct then the provision service should have queued the requests in https://localhost:1103, click on clients, should should the number of request changes the adp service is waiting to process and the number of blocked.

This number should immediately increase with the changes calculate then slowly reduce down to 0 zero again

 

The requests are then detailed in pending request before moving to completed requests. If the requests have been blocked then these should appear in the blocked log.

Can you double check that they are not being blocked

[Argh_iPads]

It does indeed match.

 

The section in clients is telling me there are 131 blocked requests. In the log, the newest of these blocked requests is back in January of this year. And does not list any of the users I'm having issues with.

 

I have found that a couple of the users with problems have finally been provisioned over night, and they now have SLG accounts in AD. However, these accounts have not yet been consolidated. I'm assuming this might happen next time ADP passes over these accounts? You'll have to bear with me, I took over this school two weeks ago without any prior experience of SLG, and I'm still getting to grips with it.

 

I'm starting to think the problem might not be with the ADP service, but something else in the chain. I know that this version of SLG has fallen quite far behind, and is in need of updating.

[Argh_iPads]

So according to the ADP web console, I am seeing that the users I'm having problems with are now being recreated every time the ADP service runs. This meas that the parents log in password keeps changing. Additionally, I have tried logging on as these parents with the info in the sims export, and I cannot log in to SLG.

 

I have combed through these user entries in sims and AD and cross reference everything with users that aren't having any issues, and all appears to be normal. I'm really stumped.

[dapaulio]

It’s ok SLG can be a mind field. We have had ours for 5/6 years now I think and I’m still learning things.

 

Sounds to me that your adp service isn’t working properly maybe from the task scheduler for some reason and when we performed the batch command it has release a load of updates.

 

Now something to understand about adp which will explain why your parents passwords keep changing. Every time you reprovision the account it gets queued in adp task. Adp will execute the requests in batches as they have been submitted therefore depending on how long the service hasn’t been working you may have thousands of requests queued. Also Depending on how many times you reprovisioned the user will be the number of times it changes the password which probably answers your last question

 

Keep running that script as administrator and refreshing the browser where you see requests until no more request get filtered through.

At least then you know your data is up to date then you can give the parent and students there most up to date passwords

 

As for consolidation this is process which you would carry out after the provisioning service has created the ad user.

First in the browser click on account tools

The consolidation tool will appear

Select the security group

Enter part of full name in name boxes

Click search

The boxes to the right will then become active then run find matches based on similar criteria between the real ad account and the slg ad account ( I use first and surname)

This will match the accounts up

Select the accounts you want to consolidate

Preview

Choose an account to keep which will be your real ad account in this situation I suspect

Then consolidate

[Argh_iPads]

Ahh, that makes a lot of sense now!

 

Forgive me, but where do I find account tools? I'm using the ADP web console, but I can see no options for account tools, or consolidation?

 

Thanks for your help with this by the way!

[dapaulio]

What version is your ADP? you will have a few lines for it by looking in uninstall programs and look for sims ADP*

 

 

no worries at all. I too had several issues which only trial and error and experience got me through. if I can spare you pain I had I should be able to sleep better tonight

Edited May 4, 2018 by dapaulio

[Argh_iPads]

I found it! We're on 7.152.4.0. It was my bad, I looked everywhere but I just didn't see it!

 

I've run the consolidation on a couple of users. Some are now working with SLG, but some are not. I'm still getting a problem with the parents not being able to log in though. I've run the script so many times, and there are no new requests. I've checked their accounts in SLG and I can see them and the appear to be fine. It's just when I got to enter their details in on the login section of our website, it won't log in.

 

Well it's nice to know I'm not the only one who's had issues like these.

[dapaulio]

In ad take a look in the user account tab. Is “user must change password on next login” checked?

 

If so I recommend clearing that and checking the password never expires.

[jthompson]

The "User must change password at next login" was a pain for us, until I discovered that it's configurable in ADP. For us, it's under Clients -> Modify -> Username Formats -> Set parents username format -> "Force password change" tickbox. When ADP was initially set up, that option was ticked.

 

I'd second the earlier comment about ADP having a huge backlog of requests to chew through if the scheduled task hasn't been running for a while. That happened to us, and even with it running every 15 mins, it still took a day or two to catch up with itself.

 

Depending on how long you've had SLG in place, you may have lots of old parent accounts hanging around in AD if you're not actively removing them. In SIMS, you can queue for deletion any parent SLG accounts that are no longer needed (i.e. ones with no students currently on roll): Routines -> ADP -> Provision Users -> Contacts/Parents -> Remove Contacts. This will disable them in AD, and you can then use Account Tools in ADP to delete them. You can reprovision them again in future if needed.

[dapaulio]

The "User must change password at next login" was a pain for us, until I discovered that it's configurable in ADP. For us, it's under Clients -> Modify -> Username Formats -> Set parents username format -> "Force password change" tickbox. When ADP was initially set up, that option was ticked.

[/quOTE]

 

I never knew that. must be a new feature in one of the updates as this bugged me for years then I just got used to it and became muscle memory nipping in to AD to disable the Flag.

See @Argh_iPads still learning

 

we have recently in the process of implementing parent App which is the SLG upgrade with a view to retire SLG come the end of the year

[dapaulio]

Ahh one problem with this is if you do not have an automated password reset facility your users will become locked out in 30days or whatever your password age policy is as this will not flag the password never expires check box

example here

https://passwordreset.scomis.org/default.aspx

 

As you have figured the passwords that are generated are in a stronger format than most of passwords you will come across on your own network so by routine we set the password never to expire but advise parents on issuing there password to follow the my account link to change their password to something that they would remember better. has worked well for years now

 

Parent App is hosted and has SSO with MS, Facebook or Twitter so no need for thousands of parent ad accounts.

Edited May 4, 2018 by dapaulio

[Argh_iPads]

Just wanted to say thanks so much for your help with this. It would appear my provisioning woes are now over!

[dapaulio]

Just wanted to say thanks so much for your help with this. It would appear my provisioning woes are now over!

 

That's great news. if you ever want any help with SLG, I have a number of years experience dealing with the little sh*ty glitches it has presented over the years we have had it and I will be happy to assist where I can.

 

We are due to decommission our SLG sometime this year in favour for Parent/student App which is the next generation SLG.

 

Good Luck

Edited May 15, 2018 by dapaulio