Important considerations for group synchronization

Nested groups

Active Directory allows administrators to add a group as a member of another group. When a group is a member of a parent group, Directory Services Connector synchronizes the users in the member group as well as users within the group explicitly identified within Directory Services Connector. The Control Console therefore includes all members of a parent group in its membership list, including those in any member groups.

Group members in other AD domains

Domain Local and Universal groups in Active Directory can contain members or groups who reside in other AD domains. In the case where group members reside in AD domains different from that of a group being synchronized, a synchronization includes only group members in that group's AD domain. To synchronize all members in a group when some members exist in different AD domains, you must synchronize all AD domains that contain members for the group.

Groups that have migrated from one AD domain to another AD domain

When a group is moved, or migrated, in Active Directory from one AD domain to another, the subsequent synchronization records this change in the Control Console. The migrated group retains the members that it previously had in the Control Console. However, the group's members continue to reside in the AD domain that they resided in prior to the migration.

Note If you moved groups in Active Directory from one AD domain to another, first perform a synchronization on the AD domain to which you moved the groups, then perform a synchronization on the groups' old AD domain. This sequence avoids a temporary deactivation of those groups in the Control Console