Confluence AD sync keeping users in group that are no longer members
Asked by Tobias Eisenhardt:

Hello,

our Confluence instance is connected to our AD, authorizing all users of the group "wiki", which inherits its users fromthe group "IT-Admins". Before the "wiki" group inherited its users from the group "IT1". Although multiple resyncs have been done, according to confluence The group "wiki" still contains all users from "IT1".

"wiki" only inherits users from "IT-Admins", which itself contains no other groups, only 7 Users. "IT1" contains 11 Users, spread to multiple groups and thus exceeding our license.


Answers:
author: AnnWorley
body: Hi Tobias,

I understand you are using an LDAP (AD) directory for user management for your Confluence server instance. The **wiki** group in AD (group used to manage permission to use Confluence) now contains only the **IT-Admins** group but formerly contained the **IT1** group. The **IT1** group members are still appearing as members of the **wiki** group in Confluence. You manually synchronized the AD User Directory in Confluence but the **IT1** group members still appear as members of **wiki** in Confluence.

My first suggestion is:

1. Make sure incremental syncronisation is disabled in the LDAP user directory in Confluence. The checkbox is under the Advanced Settings which are collapsed by default. [Connecting to an LDAP Directory](https://confluence.atlassian.com/doc/connecting-to-an-ldap-directory-229838241.html) describes all the settings and what they are for.
2. Synchronize again after disabling incremental sync.
3. Check the group memberships again

Secondly, I recommend eliminating the possibility that the **wiki** group members that are not in **IT1** are maybe in a different user directory in Confluence and appearing as members of **wiki** because of aggregating group memberships. Please see *Permissions* on [Managing Multiple Directories](https://confluence.atlassian.com/doc/managing-multiple-directories-229838494.html#ManagingMultipleDirectories-Permissions).

I look forward to hearing whether the group memberships update as expected after disabling incremental synchronization, and to any other results of your investigation.

Thanks,

Ann

comments: author: Tobias Eisenhardt
body: Hi Ann,

thanks for your reply

I checked the points you mentioned above without any change.

But I found that removing the extra domain filters for users and groups fixed the issue although I have no idea how. All users and groups in the setup were beneath the set subdomains.


author: AnnWorley
body: Hi Tobias,

That is great news to hear the group memberships synchronized properly at last. I can only speculate that synchronizing from the base DN without the additional group and user DNs forced the cache to refresh.

If your base DN is set to the top of the Active Directory, and you don't have the additional group and user DNs, you could run into: [Some users are unable to login due to Active Directory 'follow referrals' configuration](https://confluence.atlassian.com/confkb/some-users-are-unable-to-login-due-to-active-directory-follow-referrals-configuration-648217037.html) Please consider connecting to the AD global catalog server if you are not already:[How do I search from Active Directory's global catalog?](https://confluence.atlassian.com/confkb/how-do-i-search-from-active-directory-s-global-catalog-785453286.html)

Cheers,

Ann


Tags: ldap