Employee Sync Fails With DSAGUID Mismatch Error In eDiscovery Platform

Problem

 Employee sync fails with DSAGUID mismatch error in eDiscovery Platform.

Error Message

DSAGUID mismatch

Cause

There are multiple Domain Controllers (DC) available and preferred DC property is not set. Because of that, incremental employee sync gets different DC to sync from every time and suspends itself.

Solution

• Synchronization status under System > Directory and Servers > Active Directory show DSAGUID mismatch error in synchronization status.
• CMADCrawler.log show a similar error.

Part 2 - Resolution

1. Navigate to: System > Support Features > Property Browser
   1. How to set the preferred_DC property in a multiple Domain Controller environment.
      1. esa.adscrawler.preferred_dc
      2. The property value should have a format domainDN:dc;domainDN:dc.
         
         For example
         Assume there are 3 domains
         
         "DC=la-ten,DC=com", "DC=corp,DC=la-ten,DC=com" and "DC=engg,DC=corp,DC=la-ten,DC=com".
         
         We want to use the following Domain Controllers respectively.
         
         CA101.la-ten.com
         CA103.corp.la-ten.com
         CA101.engg.corp.la-ten.com
         
         Then the value for the property should be set to:the following:
         
         DC=la-ten,DC=com:CA101.la-ten.com;DC=corp,DC=la-ten,DC=com:CA103.corp.la-ten.com;DC=engg,DC=corp,DC=la-ten,DC=com:CA101.engg.corp.la-ten.com
         
         Note: A colon (:) separates the name of the domain reference and the name of the domain controller being specified to use for that domain.  The semicolon (;) separates the individual entries for each domain in which are being specified
2. To enable full sync, set esa.employeemanager.directory.sync.crawler.enablefullsync to true
3. Start Synchronization
4. After sync is complete, revert the property value to false.
   1. Incremental syncs are faster than full syncs.