Overview 💥
In some environments, partners may observe incorrect, duplicated, or unexpected values displayed on the System Details page for an Active Directory Inspector.
Common examples include:
Privileged users appearing as the system (Inspector) name
The same value repeated multiple times
Missing expected users or groups
Incorrect data shown in System Details widgets or alerts
Example :
Although this behavior may initially appear to be an inspection or metric issue, it is most commonly caused by Inspector payload trimming being enabled within the Active Directory Inspector configuration.
Symptoms 🤒
Partners may notice one or more of the following:
✅ Privileged Users list shows the Inspector friendly name repeatedly
✅ Actual Domain Admins / Enterprise Admins are missing
✅ Metrics display placeholder or incorrect values
✅ Alerts referencing incorrect identities
✅ Builder output differs from expected Active Directory results
✅ Dataprint appears incomplete or missing expected arrays
Example affected metric:
Users[?contains(Privileged, `Yes`)].Name || to_array(`-`)
Instead of returning privileged usernames, the output may display:
DomainController01
DomainController01
DomainController01
Validation in Active Directory 👨🔧
The discrepancy can typically be confirmed by querying Active Directory directly.
Example validation commands (use in elevated PowerShell):
Check privileged group membership
Get-ADGroupMember -Identity "Domain Admins" -Recursive |
Select-Object name, samaccountname, distinguishedname
Get-ADGroupMember -Identity "Domain Admins" -Recursive |
Select-Object name, samaccountname, distinguishedname
Check common privileged groups
$PrivilegedGroups = "Domain Admins","Enterprise Admins","Administrators",
"Account Operators","Server Operators","Backup Operators"
foreach ($group in $PrivilegedGroups) {
Get-ADGroupMember -Identity $group -Recursive |
Select name,samaccountname,distinguishedname,
@{Label="Group";Expression={$group}}
}
Check protected administrative accounts
Get-ADUser -Filter 'adminCount -eq 1' -Properties adminCount |
Select name,samaccountname,distinguishedname,adminCount
These results typically confirm that Active Directory contains correct data, while Liongard displays incomplete values.
Root Cause ✨
The issue occurs when Inspector Payload Trimming is enabled.
Within the Active Directory Inspector configuration, administrators may select a Trimming Level (1–5).
Trimming Level | Behavior |
Blank (Recommended) | Full dataprint collected |
Level 1–4 | Partial data reduction |
Level 5 | Maximum payload trimming |
Example:
When trimming is enabled:
Portions of the dataprint are intentionally removed
Large arrays may be reduced or excluded
Relationship mappings may be incomplete
Metrics referencing trimmed fields return fallback values
As a result:
👉 Metrics expecting arrays such as Users[].Name cannot resolve correctly.
👉 The platform may display default or repeated system values instead.
This commonly impacts:
Privileged Users
Groups
Membership relationships
Key System Details fields
Alerts relying on trimmed datasets
Why This Happens 🤔
Payload trimming exists to help environments experiencing:
Large Active Directory datasets
Payload size limits
Inspection upload failures
However, enabling aggressive trimming removes structured data required by:
System Details views
Metrics
Alerts
Reporting datasets
The Inspector itself completes successfully but not all data is collected.
Steps to Resolve 👨💻
Step 1 — Open Active Directory Inspector Configuration
Log in to your Liongard instance.
Navigate to: Admin → Inspectors=
Locate the affected Active Directory Inspector.
Click on 3 dots and select Edit Inspector.
Step 2 — Review Trimming Configuration
Locate: Inspector Payload Trimming Level
If set to: 1–5
this indicates trimming is enabled.
Step 3 — Disable Trimming (Recommended)
✅ Clear the trimming level field completely.
Leave this field blank unless directed by Liongard Support.
Step 4 — Save and Reinspect
Save the Inspector configuration.
Run the Inspector using Debug + Clear Cache option
Step 5 — Validate Results
After inspection completes:
Navigate to System Details
Confirm privileged users display correctly
Verify alerts and metrics return expected values
Review Dataprint for restored arrays
Expected Outcome ✅
After disabling trimming:
✅ Correct privileged users appear
✅ System Details populate accurately
✅ Metrics resolve properly
✅ Alerts evaluate expected identities
✅ Full Active Directory relationships return
Additional Troubleshooting 🧑🏫
If issues persist:
1️⃣ Confirm Dataprint Contains User Arrays
Check that datasets such as:
Users[]
Groups[]
GroupMemberships[]
2️⃣ Validate Inspector Health
Ensure:
Inspection completes successfully
Payload upload succeeds
No timeout or size errors exist
Best Practices ✅
✔ Leave trimming disabled by default
✔ Enable trimming only when resolving payload-size failures
✔ Use the lowest trimming level possible if required
✔ Revalidate dashboards and alerts after trimming changes
Important Note 📌
This behavior does not indicate incorrect Active Directory data or a Liongard platform defect.Liongard can only evaluate and display data included in the Inspector payload. When trimming removes required datasets, dependent metrics may produce misleading results.
Impact Scope ⚠️
Although often first noticed with Privileged Users, trimming may also affect:
Group membership visibility
System Details values
Compliance metrics
Alert accuracy
Dashboard reporting
Future metric evaluations
Related Documentation 📚
Summary 🤩
Incorrect or duplicated values shown on the Active Directory System Details page are most commonly caused by Inspector payload trimming being enabled.
Disabling trimming restores full dataprint collection and allows Liongard metrics, alerts, and dashboards to evaluate Active Directory data correctly.