-
Title
A Dynamic Group contains an incorrect membership count. A "Rebuild" of the Dynamic Group has no effect. -
Description
A Dynamic Group's membership is incorrect. Upon executing a rebuild of the group, the following error is observed in both the Active Roles Event Viewer as well as Verbose Logging:
Failed to update membership list of Dynamic Group.Details: Administration Service encountered an error when making changes to the object ''.A required audit event could not be generated for the operation. (Exception from HRESULT: 0x800721B1)Dynamic Group:Membership list of Dynamic Group is not updated until after the issue is resolved, so membership list may be incompliant with membership rules. Try forcing update of Dynamic Group from the Members tab in the Properties dialog box for Dynamic Group, in the ActiveRoles console.
Alternatively, there may be no error noted in the logging on the Active Roles host. -
Cause
Native Active Directory limitations.
CAUSE 1Active Directory requires that all operations which are processed must be logged in the Security Event Viewer log for auditing purposes. If an event cannot be logged, then it is denied.There is a default cache of 17000 entries which are held in active memory, waiting to be written to the Security log. If the operation exceeds this amount, the operation may fill the audit log cache more quickly than the Domain Controller can clear it. This means that some operations are denied, and therefore Group membership is not as expected.CAUSE 2
Active Directory is unable to track a large number of operations due to a lack of version storage. This issue is discussed in detail in this Microsoft resource. -
Resolution
RESOLUTION 1
To confirm this issue:
On the Active Directory Domain Controllers, an event similar to the following will show in the Directory Service logs:
Event ID: 2866Task Category: SecurityLevel: ErrorKeywords: ClassicUser:Computer:Description:While logging audit events for the following object, the directory service reached the maximum number of audit events that could be cached in memory at any given time. As a result of reaching this limit, the operation was aborted.Maximum number of audit events that can be cached: 17000There are two options to potentially resolve the issue.
1 - Change which operations are being audited by the Domain Controller.
- By default, the Domain Controller audits all successes and all failures. The default behavior may be changed to log only failures. This will greatly decrease the overhead on the Domain Controllers, and the configuration change can be made via Group Policy
2 - Increase the size of the audit queue.-
This is done via a registry edit on the Domain Controller
-
The key is: HKLM\System\CurrentControlSet\services\NTDS\Parameters\Maximum Audit Queue Size
-
This key is a 32-bit DWORD and should be set to a value higher than 17000 that is appropriate for the environment. The value may need to be increased if the issue persists
-
The Active Directory Domain Services service on the target Domain Controller must be restarted in order for this change to take effect.
RESOLUTION 2
To confirm this issue:
On the Active Directory Domain Controllers, one or more of the following events will show in the Directory Service logs:
Event ID: 1479Task Category: NTDSReplicationLevel: ErrorKeywords: ClassicUser:Computer:Description:Active Directory Domain Services could not update the following object in the local Active Directory Domain Services database with changes received from the following source directory service. Active Directory Domain Services does not have enough database version store to apply the changes.
Event ID: 1519Task Category: Internal ProcessingLevel: ErrorKeywords: ClassicUser:Computer:Description:Internal Error: Active Directory Domain Services could not perform an operation because the database has run out of version storage.
Event ID: 623Task Category: (14)Level: ErrorKeywords: ClassicUser:Computer:Description:The version store for this instance (0) has reached its maximum size of . It is likely that a long-running transaction is preventing cleanup of the version store and causing it to build up in size. Updates will be rejected until the long-running transaction has been completely committed or rolled back.
To resolve this issue, create the EDB max ver pages (increment over the minimum) registry key documented in this Microsoft resource on the target Active Directory Domain Controller.The possible values for this registry key are 6400 (the default), 9600, 12800, 16000, and 19200. Step through these values one-at-a-time until the issue is resolved. The Active Directory Domain Services service on the target Domain Controller must be restarted in order for this change to take effect.