GCDS Help needed

[fiza]

We have been using Google Cloud Directory Sync since 2015 and it has always worked really well. It always only looked at active users in Active Directory and any that were disabled in AD would then get suspended in Google.

Recently any disabled used in AD no longer get suspended in Google. Below is the rule we have in place.

 

 

The rule matches what Google say will return only active users from AD. https://support.google.com/a/answer/6126589#zippy=%2Cspecific-ldap-queries

 

 

• All active (not disabled) users that have email addresses in Active Directory(&(objectCategory=person)(objectClass=user)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
  

 

 

Any pointers would be most welcome.

[RLR]

What do you have under User Accounts > User Attributes > Google Domain Users/Suspension Policy?

 

I had a similar issue years ago and I contacted Google Support for help. I think it was resolved by creating a new rule to search for Suspended users and ticking the box to suspend these users in Google.

[fiza]

What do you have under User Accounts > User Attributes > Google Domain Users/Suspension Policy?

 

I had a similar issue years ago and I contacted Google Support for help. I think it was resolved by creating a new rule to search for Suspended users and ticking the box to suspend these users in Google.

 

The user Accounts > User Attributes > Google Domain Users/Suspension Policy

 

[fiza]

@RLR - Can you post the syntax you have to suspend Google accounts if disabled in AD? My Googling is only bringing up the same syntax I already have but that doesnt make sense.

[RLR]

From what I understand: (!(userAccountControl:1.2.840.113556.1.4.803:=2)) will only retrieve active users. Where as (userAccountControl:1.2.840.113556.1.4.803:=2) will retrieve disabled users (not sure if it also gets active users?).

 

As this was a while ago I will say use this at your own risk! We also have several rules that point at specific OUs rather than doing the whole domain as our disabled users go into a leavers area so we only point the disabled users search to the leavers ou.

 

I believe this is what we added:

 

 

 

 

 

(&(objectCategory=person)(objectClass=user)(mail=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

[fiza]

From what I understand: (!(userAccountControl:1.2.840.113556.1.4.803:=2)) will only retrieve active users. Where as (userAccountControl:1.2.840.113556.1.4.803:=2) will retrieve disabled users (not sure if it also gets active users?).

 

As this was a while ago I will say use this at your own risk! We also have several rules that point at specific OUs rather than doing the whole domain as our disabled users go into a leavers area so we only point the disabled users search to the leavers ou.

 

I believe this is what we added:

 

 

[ATTACH=CONFIG]70210[/ATTACH]

 

 

 

(&(objectCategory=person)(objectClass=user)(mail=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

 

That's strange because when I use the same syntax as your screenshot I get an error. If I add in another close bracket at the end then the syntax is accepted but when testing it returns 0 users.

 

[RLR]

Have you checked to see what version you're on? You have slightly different options to me.

 

Edit: You have an extra bracket "(" in your filter. It should be:

 

(&(objectCategory=person)(objectClass=user)(mail=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

Edited November 1, 2023 by RLR

[fiza]

Have you checked to see what version you're on? You have slightly different options to me.

 

Edit: You have an extra bracket "(" in your filter. It should be:

 

(&(objectCategory=person)(objectClass=user)(mail=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

 

So the existing filter has always had the extra bracket ) at the end and has always been like that. If i put in the expression the same as yours without the extra bracket then I get the syntax error as in my previous screenshot. It just doesnt make sense to me that it seems to work for you but not for me!

 

With the extra bracket I get results returned.

 

Edited November 1, 2023 by fiza

[RLR]

I think your syntax is still wrong and you need two rules. One for active users and one for disabled users. There are two filters that look almost identical. One with a "!" and extra brackets and one without:

 

Active users: (&(&(objectclass=user)(objectcategory=person)(mail=*))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

disabled users: (&(objectCategory=person)(objectClass=user)(mail=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

 

The disabled users rule should have the tick box applied to suspend users in Google.

 

Again, I use seperate OUs for active and disabled accounts in AD so my rules point to these specific OUs. I'm not quite sure how this will work with if you point both rules to the whole domain but atleast there is a test button!

[fiza]

I think your syntax is still wrong and you need two rules. One for active users and one for disabled users. There are two filters that look almost identical. One with a "!" and extra brackets and one without:

 

Active users: (&(&(objectclass=user)(objectcategory=person)(mail=*))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

disabled users: (&(objectCategory=person)(objectClass=user)(mail=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

 

The disabled users rule should have the tick box applied to suspend users in Google.

 

Again, I use seperate OUs for active and disabled accounts in AD so my rules point to these specific OUs. I'm not quite sure how this will work with if you point both rules to the whole domain but atleast there is a test button!

I don't know what's going on! I have tried putting in a second rule with the same syntax you had and with one less bracket but I get the "unbalanced Parenthesis" error I posted earlier. If I put in the extra bracket then there is no error but gives 0 results.

[RLR]

I don't know what's going on! I have tried putting in a second rule with the same syntax you had and with one less bracket but I get the "unbalanced Parenthesis" error I posted earlier. If I put in the extra bracket then there is no error but gives 0 results.

 

Odd! Maybe check the version you are running and contact Google Support. They're usually pretty quick to help if you go via the Text Chat.

[Steve21]

Slightly off topic thought, but are you sure you don’t have the OU delete/suspend settings too low?

 

Just wondering if it is still working but it’s blocked with the year roll over if you deleted/suspended a lot at once and haven’t over ridden the limit

 

Steve

[fiza]

Slightly off topic thought, but are you sure you don’t have the OU delete/suspend settings too low?

 

Just wondering if it is still working but it’s blocked with the year roll over if you deleted/suspended a lot at once and haven’t over ridden the limit

 

Steve

 

I’ve checked and I then set it to 90% and did a simulation but the same result. It did not detect disabled AD accounts and so did not say it was going to suspend any google accounts.

[k-strider]

I know this is a slightly old thread but I’ve just realised that my disabled AD objects are not getting suspended in google. They used to work and we haven’t changed them it looks like it stopped about 6 months ago probably when I updated to GCDS 5.0.28

so we do 2 rules for each ou one for Active - Working and creates users & one to suspend Not working and when you test LDAP it returns 0 results for the suspended ones

Active

(&(objectCategory=person)(objectClass=user)(mail=*@school.county.sch.uk)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

 

Suspend

(&(objectCategory=person)(objectClass=user)(mail=*@school.county.sch.uk)((userAccountControl:1.2.840.113556.1.4.803:=2)))

 

 

yes there is 1 user in the AD ou that is disabled. the Base ou is the same. ive tried sub tree and one level they both return results for active but not disabled. can i run the query in powershell against AD controller to see what it returns to me? just wondering where its broken.

 

Edit

if i put the query string into Saved Queries in ADUC it returns all my disabled users it schanges it to this but that also doesnt work in GCDS (&(&(&(objectCategory=person)(objectClass=user)(mail=*@school.county.sch.uk)(userAccountControl:1.2.840.113556.1.4.803:=2))))

Edited March 21, 2024 by k-strider