[Rebuild] - script call to rebuild a dynamic group, anyone?

Question

Ok, Scriptsmiths - do any of you have a script you use to trigger a dynamic group membership 'Rebuild' programmatically? The builtin scheduled task that performs the nightly evaluation and rebuild - lists a blank value where a script would be ..., and although I'm sure there must be a way to script-trigger the schedule task to run - I don't want to rebuild all groups. Just the one or two mammoth groups that choke during the nightly. I have a very large group or two, with 50K+ members - and last Thursday night after the general rebuild, it had only 13K users in tow. So I had 37K upset users the day after. It felt like every one of them was trying to OCS me at the same time. I launch the gui, I find the group, I click the button [Rebuild] and a few thousand seconds later - happy users. 
 Any existing script in play by an ARS admin anywhere - or an inkling of where to start with a script that lets you trigger a group rebuild from the command line without having to evaluate/rebuild all DG's at the same time? 
 tia 
 
 OMG this captcha kills me - it LOOKS LIKE A STORE FRONT TO ME!

Shawn.Ferrier · Accepted Answer

Hello, Dyannic. 
 I just tried a the code from that old post using v7.0.2 and it seemed to work just fine for me (with a minor adjustment): 
 $Constants = New-Object 'System.Object'
$Constants | Add-Member -MemberType NoteProperty -Name EDS_CONTROL_FIX -Value 4
$Constants | Add-Member -MemberType NoteProperty -Name EDS_CONTROL_CHECK_POLICY_COMPLIANCE -Value 5
$Constants | Add-Member -MemberType NoteProperty -Name DGPolicyGUID -Value "84C1A76B-2A6B-4f4b-837A-22D2CCAC777A"
$Constants | Add-Member -MemberType NoteProperty -Name ADS_PROPERTY_CLEAR -Value 1

$Group = [ADSI]"EDMS://CN=Test Dynamic Group,OU=Business Unit1,DC=qsftdemo,DC=com"
$Group.PutEx($Constants.ADS_PROPERTY_CLEAR, 'member', $null)
$Group.SetInfo()
$Group.InvokeSet('Control', $Constants.EDS_CONTROL_FIX, $true, @($Constants.DGPolicyGUID)) 
$Group.InvokeSet('Control', $Constants.EDS_CONTROL_CHECK_POLICY_COMPLIANCE, $true, @($Constants.DGPolicyGUID)) 
$Group.psbase.Invoke("CheckPropertyValues")

If "$Group.InvokeSet()" continues to fail for you, try "$Group.psbase.InvokeSet()" instead. 
 Good luck! Shawn.

Aidar.Karabalaev · Answer

consideration. 
 ARS rebuilds Dynamic Group based on "how heavy" ldap query. 
 For example, if ldap query includes memberOf AD\group_condition is "heavy" for ARS - the change of membership of the AD\group_condition will make ARS to rebuild *all* members of the Dynamic Group. In large 50K users AD it might take 12h for ARS to finish up the rebuilt. 
 Recommendation1: replace AD\group_condition to VA_condition attribute (single-valued number or string) per Dynamic Group. ldap query based on the VA is "light" and used to show time rebuilt drop from 12h+ to few min because it rebuilts the single member without affecting others already being member of the DG. 
 Option1: you may consider to ARS-focus DG group rebuilt to a dedicated new ARS server .Keep in mind that the slowdown might come form the DC response and not from ARS.

Aidar.Karabalaev · Answer

Dynamic Group membership = F(ldap query). Ldap query can be any. 
 Stress testing is a different story. ARS is coded to guaratee a *correct* build of the DG membership. DC DirSync service does not provide very transparent infromation on AD group (used for condition) membership changes, that';s why ARS needs to do very heavy recalculations on its own.

Endpoint Privilege Management

[Rebuild] - script call to rebuild a dynamic group, anyone?