LDAP sync not working for all users

[david.c.campbell70]

I have CUCM 8.6.1 and and unity Connections 8.6.1, both are synced with AD through LDAP, 99.9% fo my users show up in CUCM and unity, however I have just a few who don't show up.  I have tried restarting the Dirsync service and running a full sync of LDAP, neither has resolved the issue and ideas?                  

Any suggustions would be greatly appreciated.

[Jose Pablo Villalobos Urena]

ANy way you can get a Capture from the CUCM after you hit re-shync?

Chances are, the account are not been sync, its because the account used to sync has no permission over the user or the OU of the users are in.

Please Kudos/rate if this help!

[davrojas]

Hello David,

This is a good advise from JoseVil, i would also check if there are any differences between the working and non-working (users not showing up) to confirm if there is any missing values. So if in the  LDAP attribute for User Id you are using mail or telephoneNumber make sure the user indeed has a value for that, this might seem pretty simplistic but is sometimes overlooked.

ADSI editor is the tool i believe is used on the AD (Active Directory) perspective to check differences.

Regards,

-Tocayo

[david.c.campbell70]

Jose  I don't think I can get a packet capute this week our net admin is out and I don't have access to set anything up in the middle to capture.  I checked between a good and a bad user they are both in the same security groups and the permisions are the same for the service account that talks between unity and AD.  Also all of my users are in the same OU. 

David  I am not finding any differnce between attributes for my users, except some have multiple phone number, for my missing user i have found a match for everyfield with somebody else.

[Jose Pablo Villalobos Urena]

David,

you can set and get captures from your CUCM without the need of a external device, or any network chance, just with the OS admin password.

Please refer:

https://supportforums.cisco.com/docs/DOC-11599

Please Kudos/rate if this help!

[david.c.campbell70]

That is awesome I didn't know that, I have a capture runiing right now and the the full sync running, which seems to take forever to complete. 

[david.c.campbell70]

How long should a force resync take?

[Joseph Martini]

A quick thing to check if only some users are not syncing would be to make sure the problem users have a last name configured on the LDAP server.  Having a last name is a requirement for users to sync to CUCM.

[david.c.campbell70]

I was able to figure out that the connection to LDAP has failed.  Now to figure out why.