Forum Discussion

mperrotta's avatar
mperrotta
Brass Contributor
Sep 08, 2020

Computer Group Syncing

We are using Computer Group Syncing to synchronize our AD Group memberships into Log Analytics. It looks like the data here is incomplete, it is only capturing a portion of the systems that are a mem...
CliveWatson's avatar
CliveWatson
Former Employee
Sep 10, 2020

mperrotta 

 

So the Microsoft Managment Agent is deployed on 60 machines, but you get results from 27.  Do you have any records in the Heartbeat table for the 33?

Heartbeat
| summarize arg_max(TimeGenerated, *), count() by Computer

 You may need to add a Line #2 to the above, e.g.  if the 60 have "AD" in their name, this may help

Heartbeat
| where Computer contains "AD"
//| where Computer startswith "abc"
//| where Computer endswith "xzy"
| summarize arg_max(TimeGenerated, *), count() by Computer

 If we know you have Agent data reported to Heartbeat that rules out issues such as Firewalls etc...

See here for more help: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows-troubleshoot

mperrotta's avatar
mperrotta
Brass Contributor
Sep 11, 2020

CliveWatson 

 

Running the heartbeat query, 61 records are returned

 

If I run the below query, I only receive 31 records.

ComputerGroup
| where GroupSource == "ActiveDirectory"
| distinct Computer

 

It doesn't appear to be an agent communication issue since all of our systems are sending heartbeats. 

  • CliveWatson's avatar
    CliveWatson
    Former Employee
    Sep 12, 2020

    mperrotta 

     

    ...and are all 60 in ComputerGroup if you remove

    | where GroupSource == "ActiveDirectory"

    ?
    If not, then we have 60 working systems, but only some make it into the ComputerGroup...

Resources