Computer Group Syncing

Question

We are using Computer Group Syncing to synchronize our AD Group memberships into Log Analytics. It looks like the data here is incomplete, it is only capturing a portion of the systems that are a member of the AD group.

We have the agent installed on 60 or so systems and log analytics reports its syncing membership for 29 systems.

Are there any secrets to get this reliably working?

clivewatson · Answer

mperrotta&nbsp;
&nbsp;
So the Microsoft Managment Agent is deployed on 60 machines, but you get results from 27.&nbsp; Do you have any records in the Heartbeat table for the 33?
Heartbeat
| summarize arg_max(TimeGenerated, *), count() by Computer
&nbsp;You may need to add a Line #2 to the above, e.g.&nbsp; if the 60 have "AD" in their name, this may help
Heartbeat
| where Computer contains "AD"
//| where Computer startswith "abc"
//| where Computer endswith "xzy"
| summarize arg_max(TimeGenerated, *), count() by Computer
&nbsp;If we know you have Agent data reported to Heartbeat that rules out issues such as Firewalls etc...See here for more help:&nbsp;https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows-troubleshoot

mperrotta · Answer

CliveWatson&nbsp;&nbsp;Running the heartbeat query, 61 records are returned&nbsp;If I run the below query, I only receive 31 records.ComputerGroup
| where GroupSource == "ActiveDirectory"
| distinct Computer&nbsp;It doesn't appear to be an agent communication issue since all of our systems are sending heartbeats.&nbsp;

clivewatson · Answer

mperrotta&nbsp;
&nbsp;
...and are all 60 in ComputerGroup if you remove
| where GroupSource == "ActiveDirectory"
?If not, then we have 60 working systems, but only some make it into the ComputerGroup...

Forum Discussion

Computer Group Syncing

Share

Resources