-
Title
Several minutes after setting up Quest on a server the vas.conf gets overwritten -
Description
After setting up a QAS server, the vas.conf settings change.
-
Cause
The VAS Configuration settings in Group Policy can apply single line edits to the vas.conf. Any VAS Configuration setting in AD will add or overwrite that particular line in vas.conf, but any settings left empty will have no effect. This allows any vas.conf to be a combination of locally set parameters and centrally managed parameters.
-
Resolution
To see what changes are being applied to vas.conf by Group Policy, run the following command as root on a joined server and look at what it says about "Modifying vas.conf settings" :
/opt/quest/bin/vgptool apply
Any settings that should not be applied should be cleared in the VAS Configuration object in Group Policy, which is Computer Configuration | Unix Settings | Quest Authentication Services | VAS Configuration. Note that when a setting is cleared in the GPO, it is removed from the vas.conf, so you may have to set it back to whatever it was before the Group Policy was applied.
-
Additional Information
When two Group Policy Objects (GPOs) are applied to an Organizational Unit (OU) containing computer objects, and both have parameters configured for "vas.conf" with different values for the same parameter, the final value in the "vas.conf" file is determined by the order in which the GPOs are applied. In general, Group Policy Objects are processed in a specific order: local, site, domain, and then OU, with the last applied policy taking precedence in case of conflicting settings. Logically, in the case of Safeguard Authentication Services (SAS) Configuration without a Merge or Replace setting, the final value for a parameter in "vas.conf" will be determined by the GPO with the highest precedence that contains a setting for that particular parameter. If you need to ensure a specific value for a parameter, you should manage the order of GPO application or create a separate GPO with the desired settings and ensure it has the highest precedence for the target OU.