QNAP TVS-1272XU-RP - Domain joined but unable to view some OUs

[CHiLL]

Our QNAP TVS-1272XU-RP (firmware QTS 5.1.5.2679) is joined to our Windows domain and has been for a number of years now. We've had no issues with it for all those years and the NAS is used primarily as a backup repository for our VEEAM backup server, which uses a managed service account for authentication and this has been working all that time. It is joined to our domain using "AD authentication (domain members). However, I have found that it is no longer able to see some OUs in our AD environment, specifically, some of the root OUs, such as "Users" and "Managed Service Accounts". The OUs simply don't show up in the list of returned OUs in Control Panel > Domain Security > Edit Redundant Domain Controllers > Edit Organizational Unit. All of our other OUs seemingly appear, including other root OUs, such as "Domain Controllers", "Microsoft Exchange Security Groups", etc. Users and groups of the already selected OUs do show in the list of domain users or domain groups sections. However, we have some service accounts that live in Managed Service Accounts OU, specifically our VEEAM backup service account, which we need to continue having access. I'd rather not move these accounts to another OU that the QNAP can see, because I don't know if it's going to break anything else that may reference the account in that location.

 

This appears to have occurred since I made a change yesterday, where I selected another OU to allow some domain users to access a different share on the NAS. Though I can't seem to figure out why. I have also tried dropping the QNAP from the domain and re-adding, but it still does the same thing.

 

I'm currently at a loss as to what is happening.

Edited March 7, 2024 by CHiLL

[3s-gtech]

I've had this with NASs in the past - they've had a max number of OUs returned limit on them and they'd arbitrarily not list the ones you want. Is this configurable, or changed in a firmware update?

[CHiLL]

I've had this with NASs in the past - they've had a max number of OUs returned limit on them and they'd arbitrarily not list the ones you want. Is this configurable, or changed in a firmware update?

A firmware update was applied last week, though the backups worked up until last night, which is why it appears to be something that I triggered yesterday.

 

The QNAP is stating it is listing 117 OUs, which is the same amount of OUs returned by this Powershell command:

Get-ADOrganizationalUnit -Filter *).Count

 

Then when I count the list of actually displayed OUs, it's 2x pages of 50 entries plus a third page of 17 entries, totalling 117 - yet none of those are the OUs I'm looking for.

 

Interestingly, I have used this Powershell command to list all OUs and they're missing from the list too:

Get-ADOrganizationalUnit -Filter *

 

So maybe it isn't specifically a QNAP issue.

 

Edit: I wonder if it's because it's a container and QNAP isn't showing containers - it doesn't appear to be showing any of them. That Powershell command wouldn't either, because it's searching for OUs. A Powershell command to show containers does return them.

Edited March 7, 2024 by CHiLL