# Distinguish TrueNAS AD join progress from cached user lists > Check the join task and account-cache configuration before interpreting missing directory users in a permissions editor. - Canonical URL: https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T20:33:02+00:00 - Modified: 2026-10-29T20:33:35+00:00 - Last reviewed by DSE: 2026-10-29 - Resource type: Guide - DSE priority: Advisory - Topics: Microsoft 365 & Identity, Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Check the join task and account-cache configuration before interpreting missing directory users in a permissions editor. ## Potentially affected TrueNAS 25.10 Active Directory joins and cached directory-user displays. ## DSE recommendation Inspect join progress, errors and cache state before changing permissions to address an absent user list. ## Article Bottom line: Check the join task and the account-cache setting before treating a missing dropdown entry as an access failure. Keep directory connection, cached display and effective permissions as separate observations. ## Source fact: what the authority says The [TrueNAS 25.10 Active Directory guide](https://www.truenas.com/docs/scale/25.10/scaletutorials/credentials/directoryservices/configadscale/) says Enable Account Cache caches user and group information and makes directory users and groups available in UI dropdown menus. For large domains, it suggests considering disabled account caching to reduce load on domain controllers. The guide allows a few minutes for AD information to populate, directs checking join progress and errors in Task Manager, and ties imported user and group availability in permission editors to enabled caching. For an out-of-sync cache or fewer users than expected in permissions editors, it provides Rebuild Directory Service Cache under the Active Directory widget settings. ## What the source does not establish This article concerns the documented join-progress and cached-display investigation. It does not diagnose every AD connection failure, prescribe a domain-controller change or treat a listed user as proof of effective file access. ## Applicability questions - What join progress and errors does Task Manager currently show? - Is account caching enabled deliberately for this domain? - Which known user and group should be available in the editor? - What separate permission and authentication tests are required after the display issue is resolved? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends recording the join attempt time, task result and account-cache state before retrying configuration. Choose one known directory user and group as reference entries. Keep their identifiers in the restricted administration record so another operator can distinguish an absent entry from a similarly named local account. Have the directory owner review the cache choice for the actual domain size and workload. Do not toggle caching repeatedly without recording the starting state and intended outcome. If caching is deliberately disabled, leave the dropdown expectation open for the appropriate documented administration procedure instead of assuming the join must be broken. Where the observed problem matches the documented cache-resynchronization case, plan that action explicitly with the administrator. Preserve the task result and current display before the action. Avoid compensating for a missing dropdown by granting broad local permissions or changing ID mapping without an independent need. Keep a second checklist for actual authentication and authorized file operations. Ask the data owner which existing share and harmless test object are suitable. Separate any production permission change from the display investigation so the evidence can explain which action addressed the original symptom. ## Verification and evidence Proposed verification: inspect Task Manager for the named join attempt and record the observed completion or error. With the approved cache setting, inspect the chosen user and group in the relevant permissions editor. If a cache rebuild is authorized, compare the before-and-after display for those same entries. Then use an approved identity and harmless object to perform the separately planned access test. Record the effective identity, requested operation and result without exposing credentials. Keep a successful dropdown population and a successful authorization check as separate findings, and escalate an unexplained mismatch before altering a wider directory configuration. ## Official references - [TrueNAS — Configuring Active Directory](https://www.truenas.com/docs/scale/25.10/scaletutorials/credentials/directoryservices/configadscale/) — official product documentation; confirm the installed release and configuration. Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: TrueNAS — Configuring Active Directory - Authority: www.truenas.com - URL: https://www.truenas.com/docs/scale/25.10/scaletutorials/credentials/directoryservices/configadscale/ - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Distinguish TrueNAS AD join progress from cached user lists,” DSE Security, https://update.dsesecurity.com/updates/distinguish-truenas-ad-join-progress-from-cached-user-lists/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.