Computers randomly being removed from device control groups

Hello Paducah DOE,

if I understand correctly then

• the main group has a green folder symbol
• the DC groups are elsewhere and (more or less) yellow
• you move the computer from a green to a yellow group and it pops back to the green one

If so, that is what AD Sync does - it places the applicable computers in the appropriate group of the mirrored AD OU-structure.

Christian

Thanks for the fast response. I am not understanding what you mean by the green and yellow symbols. Here's a snip of what I see in the group structure.

We locate the computer in the root group and drag to whatever DC group we want it in. And sometimes, for no reason, the next day it is gone from the group and we do not know why. Is our SEC group structure at fault? If I understand correctly, we need AD synch in order to push updates and such to the appropriate groups. But that might be a different issue for a different day.

Hello Paducah DOE,

thanks for the screenshot - apparently you are not using what is called AD sync for short.

Allow me some general remarks first:
push updates
you don't push updates - SEC/SUM maintains one or more update locations, endpoints access their update location and download and apply the changes since the last download.
we need AD synch
short answer - you don't. It's not clear though what you mean by AD synch. Are you perhaps referring to Discover → Import from AD?

Computers don't change their group on their own. And I fear I don't quite understand what the main group or the root group is and which of the groups are "mirrors" of the AD containers. Computers move (actually or apparently) in the following cases:

1. AD Sync (the actual AD Sync) - I described this in the previous post
2. AD Import - you import groups and computers from AD, create subgroups and move some computers to the new groups. Next time you Import from AD the computers in the subgroups are moved back to parent group
3. A computer is reinstalled calling setup.exe from the command line using the -Grouppath switch (I'd rule this out in your case)
4. Certain workflows with a, let's say, unfortunate sequence of actions like installing, deriving from an image, individualising, joining can cause seemingly chaotic behaviour (I'd rule this out as well)

 I'd tend to 2.

Christian 

Hello Paducah DOE,

thanks for the screenshot - apparently you are not using what is called AD sync for short.

Allow me some general remarks first:
push updates
you don't push updates - SEC/SUM maintains one or more update locations, endpoints access their update location and download and apply the changes since the last download.
we need AD synch
short answer - you don't. It's not clear though what you mean by AD synch. Are you perhaps referring to Discover → Import from AD?

Computers don't change their group on their own. And I fear I don't quite understand what the main group or the root group is and which of the groups are "mirrors" of the AD containers. Computers move (actually or apparently) in the following cases:

1. AD Sync (the actual AD Sync) - I described this in the previous post
2. AD Import - you import groups and computers from AD, create subgroups and move some computers to the new groups. Next time you Import from AD the computers in the subgroups are moved back to parent group
3. A computer is reinstalled calling setup.exe from the command line using the -Grouppath switch (I'd rule this out in your case)
4. Certain workflows with a, let's say, unfortunate sequence of actions like installing, deriving from an image, individualising, joining can cause seemingly chaotic behaviour (I'd rule this out as well)

 I'd tend to 2.

Christian