4 Replies Latest reply on Apr 23, 2015 8:55 AM by Toby Erkson

    Does tabcmd syncgroup now truly sync?  v8.3.2

    Toby Erkson
    Toby Erkson Ambassador Mar 30, 2015 9:55 AM

      We are running Tableau Server 8.3.2.  All past experience has been that using "syncgroup" simply adds people to the Server if they don't already exist AND if they are not in the AD group -- but do exist in the Tableau Group -- they still remain in the Tableau Group.

       

      One of our project admins noticed that some users they added to their Group keep disappearing.  I added the users myself and verified they were in the correct Group.  A couple hours later they were removed from the Group!  I checked my batch script that runs every 6 hours and the particular Group I placed those people within is an Active Directory group.  When I checked that AD group those people are not in it.  So it appears to me that when my batch script runs and the syncgroup executes for that particular AD group, people not in that AD group that are present in the Tableau Group get removed from the Tableau Group!  So it appears that a true sync is occurring.

       

      Can anyone verify this for version 8.3.2 or higher?  I didn't find anything in the release notes for 8.3.+ but maybe I missed it?

        • 1. Re: Does tabcmd syncgroup now truly sync?  v8.3.2
          Jeff Strauss
          Jeff Strauss Ambassador Mar 30, 2015 2:29 PM (in response to Toby Erkson)

          Hi Toby.  The answer is yes, but I think it goes a bit deeper as it moves the user out of the group and into the "all users" category.  This according to the post has been in effect for some time now.

           

           

          See the "remove users" portion.

           

           

          Synchronize an Active Directory Group

          • 2. Re: Does tabcmd syncgroup now truly sync?  v8.3.2
            Toby Erkson
            Toby Erkson Ambassador Mar 31, 2015 8:54 AM (in response to Jeff Strauss)

            My search in the Community didn't come up with that so this is fantastic!  Thank you

            What I observed is that if the User belongs to another Group (thus they belong to two or more Groups) they will still be in the other Group(s).  They can log on to the Server and enter into the other Group(s) they belong to, just not enter the one Group where they were removed from by the sync.  I just confirmed this with an end user.

             

             

            From the link Jeff provided:

             

            Removing Users

            When you remove a user from Active Directory then synchronize with that user's group on Tableau Server, the user is:

            • Removed from the Tableau Server group you synchronized
            • Placed in the All Users group in Tableau Server
            • Unable to sign in to Tableau Server

            Because the user still remains on the server, as the administrator, you can audit and reassign the user's content before removing their account completely. The user will not be able to sign in to the server. To fully remove the user from Tableau Server you need to do the following:

            • Unlicense the user's account (if Tableau Server is using user-based licensing)
            • Delete the user from Tableau Server's All Users page
            • 3. Re: Does tabcmd syncgroup now truly sync?  v8.3.2
              Daniel Seisun
              Daniel Seisun Apr 22, 2015 6:35 PM (in response to Toby Erkson)

              Toby, the documentation you pasted seems to reference if the user is completely removed from AD. Do you know if 8.3.2 is when they added proper syncing to groups (e.g. removing users that were removed from the group)? We're on 8.3.1 and waiting for 9 to stabilize a bit, but might jump to 8.3.4 if we know that it would fix our current issue.

              • 4. Re: Does tabcmd syncgroup now truly sync?  v8.3.2
                Toby Erkson
                Toby Erkson Ambassador Apr 23, 2015 8:55 AM (in response to Daniel Seisun)

                What I pasted was from 8.1.  My "discovery" happened because of a sudden use of Tableau by a particular Tableau Group that quickly grew so I cannot pinpoint when the true synchronization actually worked as expected, I just know it does work in 8.3.2.

                 

                As for upgrading, I would recommend doing the latest version of 8, which is 8.3.4.  When the first patch comes out for 9.0 then upgrade