suddenly groups don't work

[rino19ny_]

SA 7.1R1.1 (build 17943)

i have a lot of VPN users so i use AD groups instead. the LDAP is configured correctly as this setup has been working for so long. today, all of a sudden, anyone belonging to my AD group is not getting matched. only when i specify a specific username from AD will it work.

how can i make  the AD group lookup work again?

[dcvers_]

This normally means something has changed in AD. Prime candidates are:

1. Someone have moved your AD groups to a different OU (in my experience AD admins seem to be always redesigning the OU structure)

2. The AD account used by the VPN boxes is disable, locked or the password has changed/expired.

[zanyterp_]

Is it all group lookup or just a specific group?

To help with dcvers' comments:
What does your policy trace show? TCP dump?
What does your AD team see on the server for failure?

[rino19ny_]

1. i'm the domain admin and no i didn't move anything

2. i tested the LDAP config from the management console and it passes

[rino19ny_]

well all groups from AD doesn't work.

as i've mentioned, there were no OU movements done and i've retested the LDAP config from the management console with a success return.

is there a particular event code i should look for in DC server?

[ruc_]

Start with the Policy Trace AND user access logs on SA.  A tcpdump from failed attempt will probably be the fastest way to narrow down but might not be as easy to read as the policy trace is. The test config button only helps verify basic connectivity.

[NatashaW_]

Hi, not sure if this helps, but I find that I have to toggle between / (forward slash) and \ (back slash) quite a bit to get my groups to work. Sometimes it works with domainname/group1, sometimes with domainname\group1, and sometime just with group1.

Thanks

Natasha

[-red-_]

If everything else appears to work ok, try deleting and rebuilding your role mapping rules/create a new sign-in policy and new realm and test it there.

I have seen similar behavior before, for whatever reason (with no changes on our end) we were either unable to extract AD group memberships, or better yet, we were extracting them, and they werent matching to our existing rules.

Delete/rebuild of the role mapping rules resolved it every time. If you have tried everything else with no luck, give it a go.