Skip to content

Revise USN check command and script instructions #1275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ShameenShahid wants to merge 2 commits into
base: dev
Choose a base branch
from
Draft

Revise USN check command and script instructions #1275

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bba3d0a
Revise USN check command and script instructions
ShameenShahid Jul 29, 2026
395e7ad
fix(vale): auto-fix style issues (Vale + Dale)
github-actions[bot] Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,19 +11,19 @@ sidebar_position: 40
# 403 - Zero USNs by Domain

Privilege Secure must point to a single Domain Controller (DC). This is because Privilege Secure
uses the USN values from Active Directory to determine when a group has been changed. These do no
uses the USN values from Active Directory to determine when a group changes. These do no
propagate between DCs.

When a DC is unavailable, a new one can be connected to by using the Privilege Secure UI.
When a DC is unavailable, you can connect to a new one using the Privilege Secure UI.
However, when this occurs, if the USN number is lower, Privilege Secure will not be aware of changes
to groups. This will impact access from changed groups.

![image.webp](/images/privilegesecure/4.2/discovery/admin/systemmanagement/4405051526935_image_384x376.webp)

It is recommended to force a re-sync of Privilege Secure's LDAP information when a DC is changed.
This is suggested during the next available maintenance window at the end of the day.
Netwrix recommends forcing a re-sync of Privilege Secure's LDAP information when a DC changes.
Perform the re-sync during the next available maintenance window.

The script detailed in this article can be used to zero the USN for an impacted domain.
Use the script detailed in this article to zero the USN for an impacted domain.

### Script Flow

Expand All @@ -40,9 +40,12 @@ The script detailed in this article can be used to zero the USN for an impacted

### Notes

- MongoDB shell command to check USNs by netbios. Script runs this before and after zero for the
- Command to check USNs by NetBIOS. Script runs this before and after zero for the
domain zerored. Including here for manual runs:
`db.discovery_config.find({type:"ldap_config"},{_id:0, domain_netbios:1,"sync.previous_usn":1,"sync.highest_usn":1})`

```
sudo docker exec -it $(sudo docker ps | grep mongo | cut -d' ' -f1) mongo SecureONE --eval 'DBQuery.shellBatchSize = 999999999; db.secureone_config.find( { type: "ldap_config"} ).pretty()' | grep "fqdn\|highest\|previous"
```

### Command to Create Script File, Open in VIM, and Make Executable

Expand All @@ -60,7 +63,7 @@ The script detailed in this article can be used to zero the USN for an impacted
sudo /secureone/setup/zero_domain_usns.sh
```

The Customer Success Team can assist with setting this up prior to utilization.
The Customer Success Team can assist with setting this up before use.

Here is an example of a successful run against the CSTEST domain in one of the Customer Support
labs:
Expand Down