Bottom line: Check the join task and the account-cache setting before treating a missing dropdown entry as an access failure. Keep directory connection, cached display and effective permissions as separate observations.
\nThe TrueNAS 25.10 Active Directory guide says Enable Account Cache caches user and group information and makes directory users and groups available in UI dropdown menus. For large domains, it suggests considering disabled account caching to reduce load on domain controllers. The guide allows a few minutes for AD information to populate, directs checking join progress and errors in Task Manager, and ties imported user and group availability in permission editors to enabled caching. For an out-of-sync cache or fewer users than expected in permissions editors, it provides Rebuild Directory Service Cache under the Active Directory widget settings.
\nThis article concerns the documented join-progress and cached-display investigation. It does not diagnose every AD connection failure, prescribe a domain-controller change or treat a listed user as proof of effective file access.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends recording the join attempt time, task result and account-cache state before retrying configuration. Choose one known directory user and group as reference entries. Keep their identifiers in the restricted administration record so another operator can distinguish an absent entry from a similarly named local account.
\nHave the directory owner review the cache choice for the actual domain size and workload. Do not toggle caching repeatedly without recording the starting state and intended outcome. If caching is deliberately disabled, leave the dropdown expectation open for the appropriate documented administration procedure instead of assuming the join must be broken.
\nWhere the observed problem matches the documented cache-resynchronization case, plan that action explicitly with the administrator. Preserve the task result and current display before the action. Avoid compensating for a missing dropdown by granting broad local permissions or changing ID mapping without an independent need.
\nKeep a second checklist for actual authentication and authorized file operations. Ask the data owner which existing share and harmless test object are suitable. Separate any production permission change from the display investigation so the evidence can explain which action addressed the original symptom.
\nProposed verification: inspect Task Manager for the named join attempt and record the observed completion or error. With the approved cache setting, inspect the chosen user and group in the relevant permissions editor. If a cache rebuild is authorized, compare the before-and-after display for those same entries.
\nThen use an approved identity and harmless object to perform the separately planned access test. Record the effective identity, requested operation and result without exposing credentials. Keep a successful dropdown population and a successful authorization check as separate findings, and escalate an unexplained mismatch before altering a wider directory configuration.
\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.
\n", "content_text": "Bottom line: Check the join task and the account-cache setting before treating a missing dropdown entry as an access failure. Keep directory connection, cached display and effective permissions as separate observations.\nSource fact: what the authority says\nThe TrueNAS 25.10 Active Directory guide says Enable Account Cache caches user and group information and makes directory users and groups available in UI dropdown menus. For large domains, it suggests considering disabled account caching to reduce load on domain controllers. The guide allows a few minutes for AD information to populate, directs checking join progress and errors in Task Manager, and ties imported user and group availability in permission editors to enabled caching. For an out-of-sync cache or fewer users than expected in permissions editors, it provides Rebuild Directory Service Cache under the Active Directory widget settings.\nWhat the source does not establish\nThis article concerns the documented join-progress and cached-display investigation. It does not diagnose every AD connection failure, prescribe a domain-controller change or treat a listed user as proof of effective file access.\nApplicability questions\n\nWhat join progress and errors does Task Manager currently show?\nIs account caching enabled deliberately for this domain?\nWhich known user and group should be available in the editor?\nWhat separate permission and authentication tests are required after the display issue is resolved?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends recording the join attempt time, task result and account-cache state before retrying configuration. Choose one known directory user and group as reference entries. Keep their identifiers in the restricted administration record so another operator can distinguish an absent entry from a similarly named local account.\nHave the directory owner review the cache choice for the actual domain size and workload. Do not toggle caching repeatedly without recording the starting state and intended outcome. If caching is deliberately disabled, leave the dropdown expectation open for the appropriate documented administration procedure instead of assuming the join must be broken.\nWhere the observed problem matches the documented cache-resynchronization case, plan that action explicitly with the administrator. Preserve the task result and current display before the action. Avoid compensating for a missing dropdown by granting broad local permissions or changing ID mapping without an independent need.\nKeep a second checklist for actual authentication and authorized file operations. Ask the data owner which existing share and harmless test object are suitable. Separate any production permission change from the display investigation so the evidence can explain which action addressed the original symptom.\nVerification and evidence\nProposed verification: inspect Task Manager for the named join attempt and record the observed completion or error. With the approved cache setting, inspect the chosen user and group in the relevant permissions editor. If a cache rebuild is authorized, compare the before-and-after display for those same entries.\nThen use an approved identity and harmless object to perform the separately planned access test. Record the effective identity, requested operation and result without exposing credentials. Keep a successful dropdown population and a successful authorization check as separate findings, and escalate an unexplained mismatch before altering a wider directory configuration.\nOfficial references\n\nTrueNAS — Configuring Active Directory — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "content_markdown": "Bottom line: Check the join task and the account-cache setting before treating a missing dropdown entry as an access failure. Keep directory connection, cached display and effective permissions as separate observations.\n\n## Source fact: what the authority says\n\nThe [TrueNAS 25.10 Active Directory guide](https://www.truenas.com/docs/scale/25.10/scaletutorials/credentials/directoryservices/configadscale/) says Enable Account Cache caches user and group information and makes directory users and groups available in UI dropdown menus. For large domains, it suggests considering disabled account caching to reduce load on domain controllers. The guide allows a few minutes for AD information to populate, directs checking join progress and errors in Task Manager, and ties imported user and group availability in permission editors to enabled caching. For an out-of-sync cache or fewer users than expected in permissions editors, it provides Rebuild Directory Service Cache under the Active Directory widget settings.\n\n## What the source does not establish\n\nThis article concerns the documented join-progress and cached-display investigation. It does not diagnose every AD connection failure, prescribe a domain-controller change or treat a listed user as proof of effective file access.\n\n## Applicability questions\n\n- What join progress and errors does Task Manager currently show?\n\n- Is account caching enabled deliberately for this domain?\n\n- Which known user and group should be available in the editor?\n\n- What separate permission and authentication tests are required after the display issue is resolved?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends recording the join attempt time, task result and account-cache state before retrying configuration. Choose one known directory user and group as reference entries. Keep their identifiers in the restricted administration record so another operator can distinguish an absent entry from a similarly named local account.\n\nHave the directory owner review the cache choice for the actual domain size and workload. Do not toggle caching repeatedly without recording the starting state and intended outcome. If caching is deliberately disabled, leave the dropdown expectation open for the appropriate documented administration procedure instead of assuming the join must be broken.\n\nWhere the observed problem matches the documented cache-resynchronization case, plan that action explicitly with the administrator. Preserve the task result and current display before the action. Avoid compensating for a missing dropdown by granting broad local permissions or changing ID mapping without an independent need.\n\nKeep a second checklist for actual authentication and authorized file operations. Ask the data owner which existing share and harmless test object are suitable. Separate any production permission change from the display investigation so the evidence can explain which action addressed the original symptom.\n\n## Verification and evidence\n\nProposed verification: inspect Task Manager for the named join attempt and record the observed completion or error. With the approved cache setting, inspect the chosen user and group in the relevant permissions editor. If a cache rebuild is authorized, compare the before-and-after display for those same entries.\n\nThen use an approved identity and harmless object to perform the separately planned access test. Record the effective identity, requested operation and result without exposing credentials. Keep a successful dropdown population and a successful authorization check as separate findings, and escalate an unexplained mismatch before altering a wider directory configuration.\n\n## Official references\n\n- [TrueNAS — Configuring Active Directory](https://www.truenas.com/docs/scale/25.10/scaletutorials/credentials/directoryservices/configadscale/) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/", "url": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-29" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Microsoft 365 & Identity", "item": "https://update.dsesecurity.com/topic/microsoft-365-identity/" }, { "@type": "ListItem", "position": 3, "name": "Distinguish TrueNAS AD join progress from cached user lists", "item": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/#article", "identifier": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/", "url": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/", "headline": "Distinguish TrueNAS AD join progress from cached user lists", "description": "Check the join task and account-cache configuration before interpreting missing directory users in a permissions editor.", "abstract": "Check the join task and account-cache configuration before interpreting missing directory users in a permissions editor.", "articleBody": "Bottom line: Check the join task and the account-cache setting before treating a missing dropdown entry as an access failure. Keep directory connection, cached display and effective permissions as separate observations.\nSource fact: what the authority says\nThe TrueNAS 25.10 Active Directory guide says Enable Account Cache caches user and group information and makes directory users and groups available in UI dropdown menus. For large domains, it suggests considering disabled account caching to reduce load on domain controllers. The guide allows a few minutes for AD information to populate, directs checking join progress and errors in Task Manager, and ties imported user and group availability in permission editors to enabled caching. For an out-of-sync cache or fewer users than expected in permissions editors, it provides Rebuild Directory Service Cache under the Active Directory widget settings.\nWhat the source does not establish\nThis article concerns the documented join-progress and cached-display investigation. It does not diagnose every AD connection failure, prescribe a domain-controller change or treat a listed user as proof of effective file access.\nApplicability questions\n\nWhat join progress and errors does Task Manager currently show?\nIs account caching enabled deliberately for this domain?\nWhich known user and group should be available in the editor?\nWhat separate permission and authentication tests are required after the display issue is resolved?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends recording the join attempt time, task result and account-cache state before retrying configuration. Choose one known directory user and group as reference entries. Keep their identifiers in the restricted administration record so another operator can distinguish an absent entry from a similarly named local account.\nHave the directory owner review the cache choice for the actual domain size and workload. Do not toggle caching repeatedly without recording the starting state and intended outcome. If caching is deliberately disabled, leave the dropdown expectation open for the appropriate documented administration procedure instead of assuming the join must be broken.\nWhere the observed problem matches the documented cache-resynchronization case, plan that action explicitly with the administrator. Preserve the task result and current display before the action. Avoid compensating for a missing dropdown by granting broad local permissions or changing ID mapping without an independent need.\nKeep a second checklist for actual authentication and authorized file operations. Ask the data owner which existing share and harmless test object are suitable. Separate any production permission change from the display investigation so the evidence can explain which action addressed the original symptom.\nVerification and evidence\nProposed verification: inspect Task Manager for the named join attempt and record the observed completion or error. With the approved cache setting, inspect the chosen user and group in the relevant permissions editor. If a cache rebuild is authorized, compare the before-and-after display for those same entries.\nThen use an approved identity and harmless object to perform the separately planned access test. Record the effective identity, requested operation and result without exposing credentials. Keep a successful dropdown population and a successful authorization check as separate findings, and escalate an unexplained mismatch before altering a wider directory configuration.\nOfficial references\n\nTrueNAS — Configuring Active Directory — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "datePublished": "2026-10-29T20:33:02+00:00", "dateModified": "2026-10-29T20:33:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish TrueNAS AD join progress from cached user lists" }, "articleSection": [ "Microsoft 365 & Identity", "Networks & Infrastructure" ], "keywords": [ "Microsoft 365 & Identity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Microsoft 365 & Identity", "url": "https://update.dsesecurity.com/topic/microsoft-365-identity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 551, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "TrueNAS — Configuring Active Directory", "url": "https://www.truenas.com/docs/scale/25.10/scaletutorials/credentials/directoryservices/configadscale/" } } ] } }