Agents are missing in the console after importing them from Active Directory to OSCE

- Updated:
- 15 Mar 2020
- Product/Version:
- OfficeScan 11.0
- OfficeScan 11.0
- OfficeScan XG
- OfficeScan XG.All
- Platform:
- Windows 2008 Datacenter
- Windows 2008 Datacenter 64-bit
- Windows 2008 Enterprise
- Windows 2008 Enterprise 64-bit
- Windows 2008 Server Core
- Windows 2008 Server R2 Enterprise
- Windows 2008 Standard
- Windows 2008 Standard 64-bit
- Windows 2008 Web Server Edition
- Windows 2008 Web Server Edition 64-bit
- Windows 2012 Datacenter R2
- Windows 2012 Enterprise
- Windows 2012 Server Essential R2
- Windows 2012 Server Essentials
- Windows 2012 Standard
- Windows 2012 Standard R2
- Windows 2012 Web Server Edition

Summary

When you add Active Directory users to OfficeScan (OSCE) 11.0/XG, you will notice that the Agent Management Overview is empty. There are no domains or agents displayed in the console.

Click image to enlarge.

When you click Agents > Connection Verification > Verify Now in the console, the ISS logs shows the following error:

2014-10-15 10:32:11 fe80::f929:bd51:c200:1abf%12 GET /officescan/console/html/widget/repository/widgetPool/wp1/widgetBase/modProduct/js/tm-highcharts-style.js - 4343 - fe80::f929:bd51:c200:1abf%12 Mozilla/5.0+(Windows+NT+6.3;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko https://xxx.xxx.local:4343/officescan/console/html/widget/index.php 304 0 0 0

Details

The issue occurs when you add an Active Directory sub-group in OSCE 11.0/XG. It happens because the process on how OSCE 11.0/XG pulls AD data changed from role to account-based.

In the following example, "SubAdmins" is a sub-group under the group "Admins". Adding the sub-group to OSCE 11.0/XG causes the issue.

Click image to enlarge.

As a workaround, it is recommended to add only the top layer Active Directory group, which is not a sub-group of other AD groups, in OSCE 11.0/XG.

If a customer login with account "subdomain\username", there is a limitation with Microsoft API to query domain from AD architecture. Please add this user into OfficeScan account directly or change AD architecture.