LDAP User Group Assignments not working

[lehmanp00]

Just wanted to let others know and see if anyone had any ideas for us.

Since the 9.9 update, LDAP user group assignments are not working correctly. We are getting partial assignments but the whole groups are no longer being seen by the JSS. What's even worse is that Apps and Config profiles are then pulled off of the ipads if a user is not seen as being in a group!

Example: We have a group with all 1600 High School students in it. (AD LDAP group) We assign a bunch of apps and a config profile to that LDAP group. (Assign to all users, limit to the group)
Right now we are only getting 400 users with the correct assignments, everyone else lost the apps and the profile.

Device-based assignments are fine. JSS User Groups are fine. I worked for 3 hours with JAMF support yesterday on this but they are stumped too. AD servers seem fine.

[RLR]

We're on 9.9 and not had any LDAP group issues.

The only time I've seen symptoms like yours is when we moved an LDAP group to a different OU. This meant Jamf couldn't see it anymore so we had to re-scope (search for the group again) and re-apply it.

[IT-CKrape]

I am seeing the exact same issue. I could not get anything to install, everything came up as "Pending", but after checking the app settings it appears all the apps with the issues are being limited via AD groups. Apps that are assigned to all users and all devices with now limitations are not having any problems.

Anyone else seeing this issue after updating to JSS 9.9 and if so, does anyone have a fix?

[martin]

Please note this discussion:
App distribution VPP "Pending - Application is not available to install"

Seems like you're experiencing the same.

[lehmanp00]

Ok, that makes sense. My JAMF support person said "This is looking very similar to a VPP issue we are seeing. We might roll them in together as 1 issue as it might go deeper than just VPP."

[gmillercmsd12]

Any resolution on the AD groups issue? I am seeing the same thing after adding new groups.