The server looks up the signed-in user’s AD groups (with nested
membership) and directory e-mail when the agent reports in. The result
is cached per user for about 10 minutes, with a small
random spread. A change in AD therefore reaches a machine within roughly
11 minutes, plus one policy sync.
At most 4 lookups run at the same time. Machines where the same user
is signed in share one lookup.
Domain controller unreachable: each machine
keeps its last known AD groups and mailbox until the
directory answers again. They are stored in the database, so this also
holds across a server restart. After 3 failed lookups in a row, lookups
for that domain pause for 60 seconds. Each failure is logged with the
time the machine’s groups were last confirmed, and shows in
Administration → System.
New machines with no cached AD data stay in their
fallback group (manual assignment, another matching group, or Default)
until the directory answers.
AD computer entries do not depend on the directory
at run time and keep working during an outage.
