Follow Active Directory for devices and policy

The Cloud Portal can follow the Active Directory the organization already runs. The read is one-way. Trustity does not create objects, move them, reset passwords, or write anything back to the directory.

Two choices are independent, and both start on Manual:

You can show the directory tree and keep policy manual, or keep the portal groups and assign policy by directory group.

This is not portal sign-in. User Management still uses invitations. The retired directory sync for portal users stays retired. SSO and SCIM, where enabled, still provision people who sign in to the portal. Vault still rotates local accounts only.

FileGuard is also separate. The groups under Who may open it are the groups on a signed-in Windows or Linux session. The directory read does not fill that list.

What has to be in place

• One domain-joined Windows station enrolled with TAO 4.0.3557. That build performs the read. The choice is already in the Cloud Portal. Stations on an earlier build keep manual groups, and the Active Directory view stays empty until a station on 4.0.3557 checks in. The published installer is updated when that build is released.
• The station reads its own domain as the computer account. A workgroup PC cannot read a domain. Linux stations never perform the read.
• A domain that has removed the usual read permission for authenticated users needs an explicit read grant on that one computer account.
• The read does not include passwords, LAPS secrets, or BitLocker recovery keys.

One Windows station holds the reader role. If it has checked in during the last six hours, it keeps the role. Otherwise the next enrolled Windows station on 4.0.3557 takes it. The Devices panel names the domain and the station that last read it. A new read arrives about once an hour.

Device tree

1. Open Secure Vault → Trustity Vault → Devices.
2. Set Device tree to Active Directory.
3. Wait until the panel names a domain and a reader. Before the first read it says it is waiting for one enrolled Windows station.
4. Review the organizational units. Each computer is marked TAO, No TAO, or Disabled.
5. Use the count of computers without TAO as the install list. A notice that a computer was added means: install TAO on it.
6. A notice that a computer was removed is an alert only. The enrolled station stays in the portal until you remove it yourself.

The first read does not raise a notice for every computer that already exists. Later reads notice a newly enabled computer, and a computer object that disappeared.

Manual groups remain available when you switch Device tree back to Manual.

Policy assignment

1. Open Overview → Security Policies.
2. Set Policy assignment to Active Directory. The line under the control says rules follow Active Directory computer groups from the latest read.
3. On a tab that supports a scope, open Apply this policy to.
4. Choose All computers (organization) for the tenant default, or one computer group from the read.
5. Save that tab and confirm the success message.
6. On a pilot computer in that group, confirm the agent picked up the new policy version.

The same tabs support a directory group as a portal device group: VisionX, ZeroDevice, GenGuard inside TAO, and HostGuard IPS. The organization policy is still the base. The group adds an overlay for computers in that group.

A computer in several groups receives each overlay. When two groups set the same field, the group whose security identifier comes later in alphabetical order wins.

These tabs stay organization-wide in either mode: TAO Agent hardening, FileGuard, PAM rotation, and Vault file and share limits.

Switch Policy assignment back to Manual to return Apply this policy to to the device groups you created. Directory overlays are not applied while the control is Manual.

Troubleshooting

Waiting for one enrolled Windows station

No station on TAO 4.0.3557 has read the domain yet. Confirm a domain-joined Windows station is online and on that build, then wait for its next check-in. The read is not every heartbeat.

The station is enrolled and the tree stays empty

Confirm the station is joined to the domain you expect, and that its computer account can read computer objects and organizational units. A hardened domain often needs that read granted on the reader’s computer account. A workgroup station cannot supply the tree.

Policy groups are empty

Groups appear after the first successful read. Device tree and policy assignment share that read, even when only one of the two controls is set to Active Directory.

A large domain looks incomplete

A domain that exceeds one read is still shown, and the snapshot is marked truncated. Treat a truncated tree as a partial view before you conclude a computer is absent.

A removed computer is still under Managed devices

That is expected. The notice records that the directory object disappeared. Removing the TAO station is a separate action on the device.

Related guides

• Security Policies hub
• Managed devices and software inventory
• SSO and SCIM enterprise identity
• Classify a file and choose who may open it
• PAM: local account password rotation