CA Client Automation

 View Only

cmdirengjob.exe (Default Directory Synchronization Job) is logging on every 1 or 2 sec to AD

  • 1.  cmdirengjob.exe (Default Directory Synchronization Job) is logging on every 1 or 2 sec to AD

    Posted Sep 11, 2019 02:58 AM
    ​Running ITCA 14.0.2

    When running the "Default Directory Synchronization Job" we notice that the user defined in Control Panel - Directory Integration - Configured Directories is logging on every one or two seconds to active directory as long as the cmdirengjob.exe is running.

    From support : The job does a high amount data read and load, because it checks and connects to every AD configured in ITCM to retrieve information about computers and users stored in mdb, more specifically, column uri of tables "ca_discovered_hardware" and "ca_discovered_user" are updated by this process, so if you have big numbers there, you may see te behavior you are seeing.

    From support : this job has not received any change from previous versions, so the way it works now is the way it has always worked, I don't think we can change this behavior. You told me you configured this job to run frequently, but based on the amount of records it reads, each run may take a lot, maybe you can try changing the scheduling to once per day or every 2 days, I don't think a directory should change that much in few days, and if it does, you can always execute the job on demand clicking it from the Engine.

    Indeed AD does not change that frequently but the reason why we are running this job so frequently is to have 'new' computer objects as fast as possible synchronized with AD because all our Configuration Policies relies on the AD structure. First important applied policy is the scalability server assignment to a new dsm agent. When this is done, users and admins can start deploying software to the new computer. If they need to wait at least 1 or 2 days, they are complaining.

    My question: is a possibility to synchronize only 1 computer object with AD, this would help us tremendously and then we only need to run the cmDirEngJob.exe only once a day.

    My remark: at the other hand, the cmdirengjob.exe should logon only once to AD at the start of the process and logoff once at the end of the process.