8 September,16 at 05:24 PM
Applies to:
Centrify DirectControl 5.3.1 and higher on all platforms
Question:
Is there a way to update a single AD object in the DirectControl cache? Adflush works but it has no granular control for large or complex AD environments.
Answer:
Starting in DirectControl 5.3.1 we introduced a new command called "adobjectrefresh" to update the cache for a specific user or group object instead of the entire zone.
Due to all the latencies (AD replication, adclient cache update) after the user or group was added to request privilege (login or dzdo) or role assignments and due to the unpredictability of when this takes effect on the target machine, we need a new CLI to flush and refresh specific user/group immediately.
This new command provides a CLI to ask adclient to flush and refresh a specific user/group object immediately. The new CLI should be able to refresh user/group based on unixname/samAccountName/DN/UPN.
Currently adflush -O <GUID> can flush a specific GUID, but it's not exposed to customer, and is not convenient.
Things we need to know before using this command:adobjectrefresh [-f] -u username [-u username, … …]
adobjectrefresh [-f] -g groupname [-g groupname, … …]
-f, --force force flush the object even if adclient is in disconnected mode
-u, --user refresh user
-g, --group refresh group
adobjectrefresh also support multiple groups and can be specified with the following format:
adobjectrefresh -u u1 -u u2@domain -g g1 -g g2
More detailed information on the command from the man page:
NAME
adobjectrefresh - Refresh a user or group.
SYNOPSIS
adobjectrefresh [-g, --group groupname ] [-u, --user username ] [-i,
--ignoremembers] [-f, --force] [-h, --help] [-v, --version] [-V, --verbose]
EXAMPLES
To refresh a user on a connected computer:
adobjectrefresh -u username
To flush a group from the Centrify cache on a disconnected computer:
adobjectrefresh -fg groupname
To refresh a group without refreshing the group's members on a connected computer:
adobjectrefresh -gi groupname