Troubleshooting the issue when the group based policy fails to work on an individual endpoint.

Logging

Turn on the specific logger level for the group resolution service. User the sqlite tool (as described in KB TECH219080) against cg.ead under the agent installation directory and input the following SQL statement:

insert or replace into configuration values('Logging', 'UserGroupResolverLevel', 'str', 'FINEST');

Agent needs to be restarted for this to effect. The logger level can also be changed by the "change log level" agent management task through Altiris console. In that case, no agent restart required.

Normally the log (edpa_ext*.log) shows the following texts if the group resolution succeeds. Otherwise there could be failure and error code recorded.

06/03/2009 17:00:41 |  2332 | FINER   | UserGroupResolver | Create group resolution task for:enforce\USERA.
06/03/2009 17:00:41 |  2332 | FINER   | UserGroupResolver | Impersonated as user [ENFORCE\USERA].
06/03/2009 17:00:45 |  2332 | FINER   | UserGroupResolver | Done impersonation. Reverted to self.
06/03/2009 17:00:45 |  2332 | FINER   | UserGroupResolver | User [ENFORCE\AUSERA] groups resolved as:
 CN=USER A,OU=CITY,DC=enforce,DC=EXAMPLE,DC=symantec,DC=com
 CN=CERTSVC_DCOM_ACCESS,CN=Users,DC=enforce,DC=EXAMPLE,DC=symantec,DC=com
 CN=Domain Users,CN=Users,DC=enforce,DC=engdlp,DC=symantec,DC=com
 CN=EXAMPLE Group,OU=CITY,DC=enforce,DC=EXAMPLE,DC=symantec,DC=com
 CN=Users,CN=Builtin,DC=enforce,DC=EXAMPLE,DC=symantec,DC=com

Persisted user group membership

It would be useful to display what the agent has resolved for user group membership. User the sqlite tool against grp.ead under the agent installation directory and input the following SQL statement:

select * from usergroups;

The output is normally in the following format. Look for the particular user name (usually the logon user). If there's no such entry or the membership of that user is wrong, some errors should have happened in group resolution task. The error log should exist in edpa_ext*.log.

ENFORCE|USERA|CN=USERA,OU=CITY,DC=enforce,DC=EXAMPLE,DC=symantec,DC=com
ENFORCE|USERA|CN=CERTSVC_DCOM_ACCESS,CN=Users,DC=enforce,DC=engdlp,DC=symantec,D
C=com
ENFORCE|USERA|CN=Domain Users,CN=Users,DC=enforce,DC=EXAMPLE,DC=symantec,DC=com
ENFORCE|USERA|CN=CITY Dist Group,OU=CITY,DC=enforce,DC=EXAMPLE,DC=symantec,DC
=com
ENFORCE|USERA|CN=Users,CN=Builtin,DC=enforce,DC=engdlp,DC=symantec,DC=com

You can turn on debugging logging for the LDAP query string:

In ManagerLogging.properties

 com.vontu.enforce.directory.domain.DefaultLdapInterface.level = FINE

An example query string for “USER NAME”:

(&(|(name=*USER*NAME*)(mail=*USER NAME*))(!(objectClass=computer)))