000037251 - Active Directory Account Data Collection fails to retrieve Active Directory attributes when connecting to Active Directory Global Catalog port 3268 in RSA Identity Governance & Lifecycle

Active Directory Account Data Collection fails to populate Active Directory attributes such as accountExpires, etc. during account collection. The issue happens when connecting to Active Directory Global Catalog on port 3268 instead of on port 636 (SSL) or plain (389).

The following error is also observed in the aveksaServer.log:

10/17/2018 16:37:29.808 ERROR (ApplyChangesRegularThread-31460) [com.aveksa.collector.accountdata.ADAccountDataReader] Problem listing attributes: 
java.lang.NullPointerException
 at com.aveksa.collector.accountdata.ADAccountDataReader.getADDomainAttributes(ADAccountDataReader.java:894)
 at com.aveksa.collector.accountdata.ADAccountDataReader$ADAccountDataDirectoryIterator.<init>(ADAccountDataReader.java:922)
 at com.aveksa.collector.accountdata.ADAccountDataReader.createAccountDataDirectoryIterator(ADAccountDataReader.java:641)
 at com.aveksa.collector.accountdata.ADAccountDataReader.createAccountDataDirectoryIterator(ADAccountDataReader.java:62)
 at com.aveksa.collector.accountdata.LdapAccountDataReader.getAccountIterator(LdapAccountDataReader.java:172)
 at com.aveksa.client.datacollector.collectors.accountdatacollectors.AccountDataCollector.collectData(AccountDataCollector.java:393)
 at com.aveksa.client.datacollector.collectors.accountdatacollectors.AccountDataCollector.collect(AccountDataCollector.java:302)
 at com.aveksa.client.datacollector.collectors.accountdatacollectors.AccountDataCollector.collect(AccountDataCollector.java:269)
 at com.aveksa.client.datacollector.framework.DataCollectorManager.collect(DataCollectorManager.java:536)
 at com.aveksa.client.component.collector.DefaultCollectorManager.actUpon(DefaultCollectorManager.java:204)
 at com.aveksa.client.component.collector.DefaultCollectorManager.handle(DefaultCollectorManager.java:102)
 at com.aveksa.client.component.event.DefaultEventManager.handle(DefaultEventManager.java:60)
 at com.aveksa.client.datacollector.framework.SimpleEventSource.notifyListeners(SimpleEventSource.java:67)
 at com.aveksa.client.component.communication.DefaultCommunicationManager.notifyEvent(DefaultCommunicationManager.java:377)
 at com.aveksa.client.component.communication.ChangeListHandler.applyChanges(ChangeListHandler.java:364)
 at com.aveksa.client.component.communication.ChangeListHandler.access$300(ChangeListHandler.java:58)
 at com.aveksa.client.component.communication.ChangeListHandler$ChangeApplyingRunnable.run(ChangeListHandler.java:275)
 at java.lang.Thread.run(Thread.java:748)

Prerequisites

1. Login as an Administrator into the Active Directory server and make sure that the Active Directory Schema is listed in the Microsoft Management Console (MMC). 
2. If the Active Directory Schema is not available in the console then configure using the steps in the section below entitled Add Active Directory Schema to MMC.  Otherwise skip to the section on Add Attribute to Global Catalog.

Add Active Directory Schema to MMC

We need to make a change to the registry on the AD Server, so that we can modify the  AD Schema.

1. From a command prompt open the registry using regedt32.exe or regedit.exe.
2. Locate the HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\NTDS\Parameters key.
3. Create a new REG_DWORD value called Schema Update Allowed and set the value to 1.
4. Register the schema management MMC snap-in, register the schmmgmt.dll.
5. Open a command prompt as an administrator and execute the command regsvr32.exe schmmgmt.dll.

6. Open the windows Run box and type mmc to open the Microsoft Management Console.
7. From the menu select File > Add/Remove Snap-In.
8. Select Active Directory Schema then click Add.
9. Click OK. The Active Directory schema should be listed in the console now.

Note: If the AD schema is not available, restart the Windows server and try again.

Add Attribute to Global Catalog

In the Active Directory schema, enable the required attribute to update in the global catalog of AD.

1. Open the MMC console and select “Active Directory Schema” in the directory
2. Select the Attributes folder, it will display the list of attributes in the pane on the right.
3. Select the required attribute, right click and open the Properties window. For exmaple, use accountExpires
4. In the Properties dialog, enable the Replicate this attribute to the Global Catalog option and click OK to save the changes.
5. The selected attribute will be added to the global catalog