JIT Multisite AD sync delay

[anon474]

What solutions are you guys using to lower or remove the delay time when updating the JIT access group? I currently have to wait 5-10 minutes for AD sync to replicate out to all the DCs before I can use the JIT access. I know that I can do a force AD sync, but I'm looking to find a way that didn't require a manual AD sync after every JIT request.

[ryannewington]

Hey @anon474

Can you tell me a bit more about your setup here.

Are you talking about JIT for computers or JIT for roles?

JIT for computers uses AD sites to try to locate the closest DC for that computer, which is where it will make the JIT group modification. So we wouldn't expect to see an issue here, unless there was a problem resolving the client site.

JIT for roles currently uses the AMS server's DC to make the change. So there could be a delay if the service you are JITing into is in another site.

[anon474]

JIT for computers, currently our AD sites are set to do an AD sync at the lowest schedule timer of 15 mins. We are looking to remove the schedule and set the sites to do instant replication but wanted to get some input from others and see how there configured.

We currently have 3 sites with 4 DCs, the lowest bandwidth at one of our sites is 100Mbps.

Here is a site that has some of details I'm talking about. https://evotec.xyz/active-directory-instant-replication-between-sites-with-powershell/

[ryannewington]

@anon474 I know many organizations that are using that capability. As long as your bandwidth between sites is adequate, then it's not too much of an issue for modern networks.

However, you shouldn't be seeing delays for JIT for computers. AMS should be finding the DC closest to the JIT target computer and making the modification there. Unless there is an issue where some clients are not located in a site?