From bba3d0a249cd277980438d7397173a7ae117d767 Mon Sep 17 00:00:00 2001 From: Shamin Shahid Date: Wed, 29 Jul 2026 05:18:40 +0500 Subject: [PATCH 1/2] Revise USN check command and script instructions Updated command to check USN. Previous command was obselete and doesn't work. --- .../2.22/administration/systemmanagement/403zerousns.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md b/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md index 125dd5bfd2..93b261283b 100644 --- a/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md +++ b/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md @@ -40,9 +40,12 @@ The script detailed in this article can be used to zero the USN for an impacted ### Notes -- MongoDB shell command to check USNs by netbios. Script runs this before and after zero for the +- Command to check USNs by NetBIOS. Script runs this before and after zero for the domain zerored. Including here for manual runs: - `db.discovery_config.find({type:"ldap_config"},{_id:0, domain_netbios:1,"sync.previous_usn":1,"sync.highest_usn":1})` + +``` + sudo docker exec -it $(sudo docker ps | grep mongo | cut -d' ' -f1) mongo SecureONE --eval 'DBQuery.shellBatchSize = 999999999; db.secureone_config.find( { type: "ldap_config"} ).pretty()' | grep "fqdn\|highest\|previous" +``` ### Command to Create Script File, Open in VIM, and Make Executable From 395e7ad0bdfb4b10062f3bdff17ddab70e2a79cd Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 00:22:13 +0000 Subject: [PATCH 2/2] fix(vale): auto-fix style issues (Vale + Dale) --- .../administration/systemmanagement/403zerousns.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md b/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md index 93b261283b..3a2496c853 100644 --- a/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md +++ b/docs/privilegesecurediscovery/2.22/administration/systemmanagement/403zerousns.md @@ -11,19 +11,19 @@ sidebar_position: 40 # 403 - Zero USNs by Domain Privilege Secure must point to a single Domain Controller (DC). This is because Privilege Secure -uses the USN values from Active Directory to determine when a group has been changed. These do no +uses the USN values from Active Directory to determine when a group changes. These do no propagate between DCs. -When a DC is unavailable, a new one can be connected to by using the Privilege Secure UI. +When a DC is unavailable, you can connect to a new one using the Privilege Secure UI. However, when this occurs, if the USN number is lower, Privilege Secure will not be aware of changes to groups. This will impact access from changed groups. ![image.webp](/images/privilegesecure/4.2/discovery/admin/systemmanagement/4405051526935_image_384x376.webp) -It is recommended to force a re-sync of Privilege Secure's LDAP information when a DC is changed. -This is suggested during the next available maintenance window at the end of the day. +Netwrix recommends forcing a re-sync of Privilege Secure's LDAP information when a DC changes. +Perform the re-sync during the next available maintenance window. -The script detailed in this article can be used to zero the USN for an impacted domain. +Use the script detailed in this article to zero the USN for an impacted domain. ### Script Flow @@ -63,7 +63,7 @@ The script detailed in this article can be used to zero the USN for an impacted sudo /secureone/setup/zero_domain_usns.sh ``` -The Customer Success Team can assist with setting this up prior to utilization. +The Customer Success Team can assist with setting this up before use. Here is an example of a successful run against the CSTEST domain in one of the Customer Support labs: