Device and Group Discovery (DGD) FAQ

---

What Device OS is imported from AD and supported?

• For the time being, we will be syncing only Windows computers and server.

 

What are unprotected/unmanaged devices?

• Unprotected devices are devices not installed with Sophos Endpoint technology.
• By comparing devices running Sophos Endpoint technology, with devices imported from AD, Central identified unprotected devices.

 

When will a new device or group be created in Central?

• When there is no other object already in Central with the same ObjectGUID.
• If the group name already exists because it has been manually created, the name will have a distinguished name(dn) for the group.

 

If the machine is already in a manually created group and then the name of the device group is different. Will it be moved to that group or will it remain in the manual group?

• Matched devices will always move to the synced group regardless of where they reside prior to syncing

How does the mapping between ADSync device and an endpoint work?

• The mapping is based on the fully qualified domain name + hostname; The fully qualified domain name is extracted from the fqdn of the endpoint.
• If an endpoint already exists in Central, not linked to any ADSync object yet, with the same hostname and domain as an object imported by AD, Central will link them together.
• When an ADSync object is already mapped to another endpoint, we will move the existing endpoint to the AD synced group.
• If an endpoint already exists in Central with the same domain + hostname as an object imported by AD, but the stored AD in Central does not match the one provided in AD sync tool, Central will update the existing endpoint record object with the details of the newly imported object and we will move the existing endpoint to the AD group.

What are Organizational Units (OU) and how can I use them?

• In the context of Central an OU is a group of devices. An OU may contain nested groups of OUs.
  • Central will allow you to delete or move ADSync computers/servers.
  • Central will allow you to delete or move ADSync computer/server groups
  • Central will not allow you to edit ADSync computers/servers.
  • Central will not allow you to edit ADSync computer/server groups.

Can I create nested groups (OU) in the Central UI?

• Yes.

What happens if a protected machine in Central is deleted in AD?

• The next AD sync will move it to a non-synced group structure and will update the endpoint details to reflect the fact that it is no longer an AD managed device.  The ADSync object will be deleted.

 

What if there are two endpoints with the same FQDN?

• The old endpoint record will be unlinked from the ADSync object, and the new endpoint record will be linked instead.

How do changes to devices or the group structure in AD impact Central?

• Changes made in AD to the name of the device or operating system details of objects already synced in Central will be updated in Central in future synchronization events.
  • Changes to the structure will be reflected in Central during  the next synchronization, including removal of devices and groups or moving devices to a different OU group.

What happens to policies that have been assigned to manually created groups that already exist in Central?

• Policies and manually created groups are unaffected by ADSync, they will be left intact.
  • If you are syncing devices and device groups, then any devices that were in the manually created groups will be moved to the synchronized group.

If a machine is moved to another group or deleted in Central, what will happen in the next sync?

• ADSync would bring the machine back in on the next sync.

If a policy is applied to a top level group and a nested group has no policy assignment, will it inherit the top level policy?

• Yes

If the machine is already in a manually created group and then the name of the device group is different will the machine be moved to that group or will it remain in the manual group?

• Matched devices will always move to the synced group regardless of where they reside prior to syncing

Are there any directory device and device group APIs?

• Not yet

Are multiple AD records with the same DN supported?

• No

---

Just corrected some typos
[edited by: DarrenTeagles at 1:48 PM (GMT -7) on 21 Sep 2020]