LDAP Security Group Delta Import is Leaving Rows in Pending State.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
15m ago
Hi Community,
I am currently troubleshooting an LDAP Security Group Delta Import issue and would appreciate any guidance from anyone who has experience with LDAP integrations and delta imports in ServiceNow.
Background
I have configured an LDAP OU Definition for Security Group Delta Imports with the following filter:
(&(objectClass=group)(whenChanged>=20261113130925.0Z))
The intention is to import only Security Groups that have been modified in Active Directory after the specified timestamp.
Issue Observed
Although the delta import runs successfully, the behavior does not seem to match my expectation.
In the latest run:
- Updated records: 293
- Pending records: 502
- Inserted records: 2
A large number of Security Groups are still being loaded and processed even though there has been no known change to the groups that I would expect to trigger a delta import.
The Import Set is created successfully and the Transform Map is executed, but many rows remain in a Pending state and the overall volume of imported records appears significantly higher than expected.
What I Am Trying to Understand
- Is the whenChanged LDAP attribute reliable for Security Group Delta Imports, or can it be updated for changes that are not obvious from a ServiceNow perspective?
- Can Active Directory update the whenChanged value due to membership changes, replication activities, or other metadata updates, causing groups to be included in the delta import even though no meaningful group data has changed?
- Has anyone encountered a situation where a large number of Import Set Rows remain in Pending state after processing?
- Is there a recommended way to import only Security Groups where specific attributes have changed rather than any update that changes the whenChanged timestamp?
- Is there a way to determine whether the issue is occurring during the LDAP query itself or during the Transform Map processing stage?
My main concern is that the delta import appears to be loading Security Group records that have not had any expected business changes, and I am trying to understand whether this is expected LDAP behavior or if there is an issue with the filter or transform processing.
Any insights, recommendations, or examples from similar implementations would be greatly appreciated.
Thank you in advance for your help.
