How Helpdesk workers and contacts are updated

Helpdesk workers and contacts are usually synced from Notification Server's (NS) users, which in turn are usually synched from Microsoft Active Directory (AD) users. (They can also be manually created directly in Helpdesk.) Making changes to the users in AD may take time to apply to NS users, which in turn then may take time to apply to Helpdesk workers and contacts. Making a change in Helpdesk to a worker or contact may therefore be reset later by these syncs. The correct procedure to make changes to users is to do so first in AD, allow that to sync to NS users, then allow the sync to Helpdesk workers and contacts. Additional information on how this process works can be found in the following article:

Helpdesk Active Directory import does not work and contacts or workers are not updating
http://www.symantec.com/business/support/index?page=content&id=TECH41705

What happens when an AD user's information changes 

A user may have their name or email address changed in AD. This can occur, for example, if the user becomes married or changes domains. Depending on what is changed in AD, a new "duplicate" user record may be then created in NS during the next AD sync. When Helpdesk's sync later occurs, this will then create a "duplicate" contact. This is working as designed, as key fields in AD have changed, resulting in what NS and Helpdesk see as a completely different user. Note: This will occur if the AD user name or account is changed, but not if just the email address is changed.

How to correctly change a Helpdesk worker and contact name, email address, and NT ID 

When a user that has a duplicate contact next uses Helpdesk, they won't see their prior incidents, etc., as they now have a different ID. This can be prevented by following the below instructions:

1. Disable Helpdesk syncs by going to Configuration > Server Settings > Notification Server Settings > Incident Settings. Uncheck Synchronize resource and incident data with Notification Server and then click on the Apply button.
2. Change the user's name, account and their email address in AD, as needed.
3. Run the Notification Server's Microsoft Active Directory Import for users. This will import a new user with the new name and email address. The old user will not be deleted or changed. To access this function, in the Altiris Console go to Configuration > Server Settings > Notification Server Infrastructure > Microsoft Active Directory Import.
4. Delete the old user in the Notification Server. This requires that CMDB Solution be installed. Go to Resources > Organizational Types > User. Use the Find function to locate the old user, then right click on them and choose Delete. Note: This may remove other related associations to the user in NS, such as associated assets, etc. These will need to all be manually re-added as needed.
5. Change the worker's email address and NT ID. In Helpdesk, go to Workers > List Workers. Select and edit the worker to change. Change their name as needed, their email address, and NT ID. Save the changes. Note: This will also change the matching contact record data.
6. Re-enable Helpdesk syncs by following step 1 but enable Synchronize.
7. The user may need to delete their Windows Profile and then reboot their workstation to ensure that the new NT ID is used from AD if prompted to create a new worker when accessing Helpdesk. When they then log back in as the changed user name, a new profile will be made. Logging into Helpdesk should then match this with the changed worker and contact records.

A duplicate contact and worker already exists

If there are already duplicate contacts, then this issue will need to be manually resolved by manipulating the name, email address, and NT ID fields of the affected contacts. Follow the below instructions to do this:

1. A new contact may only have been made through the Helpdesk sync, or a new contact and a new worker may be made from the user logging into Helpdesk and creating a second worker. In Helpdesk, verify that the new contact and worker exist. Go to Contacts > Find Contacts. Go to Workers > List Workers.
2. Edit the new worker if one exists. Set Active to be disabled. Change the name, email address, and NT ID to unused, fake ones. Save the changes.
3. Edit the the old worker if a new one exists. Change the name, email address, and NT ID to be those of the new worker (before being changed to unused ones, from step 2). Save the changes.
4. If a new worker was exists, go to Contacts > Find Contacts. Locate the new contact, edit the record, and set Active to be disabled. Save the changes. Note: Both contact's data should have been automatically changed when changes were made to the corresponding worker records.
5. If only a new contact was created, no new worker was, change the name, email address, and NT ID to the new ones. When the Helpdesk sync next runs, the Notification Server record, from step 4, in the above section, should then automatically synch to the changed contact in Helpdesk.
6. The user may need to delete their Windows Profile and then reboot their workstation to ensure that the new NT ID is used from AD if prompted to create a new worker when accessing Helpdesk. When they then log back in as the changed user name, a new profile will be made. Logging into Helpdesk should then match this with the changed worker and contact records.
7. To verify if duplicates already exist, the following SQL queries can be ran:
   
   USE Altiris
   SELECT Name, Email
   FROM vUser
   WHERE Email like '%<part of the email to be checked>%'
   ORDER BY Email
   
   For example, if Jane Doe was married and then her name was changed to Jane Smith, the email address should also be changed (but not necessarily). To check this, the WHERE statement would then be
   
   WHERE Email like '%jane%'
   
   So that this catches any variations.
   
   Similarly, this can be adapted for Helpdesk:
   
   USE Altiris_Incidents
   SELECT Name, Email
   FROM Contact
   WHERE Email like '%<part of the email to be checked>%'
   ORDER BY Email
   
   Or use "FROM Worker" to check the worker table, which should be the same as what is found in the contact table.

Advanced troubleshooting

• If when saving any changes to the worker account(s), Helpdesk prompts to overwrite or change the contact, this may result in a broken relationship with the record. Ensure that the correct fields are changed according to the above instructions.
• If the above manual solution fails to resolve the issue, the records in the database may  need to be adjusted. The following information describes how this can be done. Note: Symantec Technical Support is unable to assist customers in correcting issues data discrepancies in the database. Please contact your company's DBA for assistance in using SQL.

Contacts are found in the Altiris_Incidents > Contact table. The ID field is the unique key field for each contact.

Workers are found in the Altiris_Incidents > Worker table. The ID field is the unique key field for each worker, and the record will also includes the Contact_ID field, which is the same value for the contact from its ID field.

Direct changes to both records for the user may need to be performed, such as setting the Worker record's Status value to "i" for Inactive.

Note: Before making any SQL changes, it is strongly recommended to back up the Helpdesk database.

• In some cases, more than one Notification Server may be present in the environment. These may be referred incorrectly to as "the stand-alone Notification Server" and "the Helpdesk Server". In actuality, there are two Notification Servers, with Helpdesk (software) running on one of them. Helpdesk in itself is not a server. What is likely occurring is that the "stand-alone Notification Server" is a parent server in a hierarchy and the "Helpdesk Server" is a child. This often involves having inventory, users and/or computers, sent from the parent to the child. It's also possible that separate AD syncs are being performed independently of each other, further complicating the environment. If this is not understood and managed correctly, this will result in confusion over what server to make changes to users on.  A correctly managed environment such as this should look like the following, for reference:
  
  Notification Server 1 (a.k.a., "stand-alone NS")
  This is the parent NS.
  This should perform an AD sync of users and computers (if so desired).
  This should be set to be the client facing NS, meaning agents check into it from clients with inventory.
  Inventory (users and computers) is then set to be forwarded to the child NS (see below).
  
  Notification Server 2 (a.k.a., "the Helpdesk Server")
  This is the child NS.
  This receives forwarded inventory from the parent NS.
  This server should not have any clients, nor should it be performing any AD syncs.
  This server runs Helpdesk Solution.
  
  To change a worker or contact name, the following then occurs:
  
  a. Change the user in AD.
  b. The change is then updated by schedule on NS 1. This may take a day or longer, depending on what the sync schedule is configured to be.
  c. The above instructions are then performed to avoid duplicates in the NS Resources.
  d. NS 1 later sends inventory to NS 2 on its schedule. This may take a day or longer, depending on what the inventory forwarding schedule is configured to be.
  e. NS 2 receives the forwarded inventory.
  f. Upon the next sync from Helpdesk, which is by default every hour, the user's contact/worker records are then updated.

Further cleaning up the database

It may be desired to manually change records in the Helpdesk database to retroactively fix issues caused by incorrectly changing user data. While this is not recommended (the above procedures are the recommended way of resolving this), this can nevertheless be done by switching IDs in SQL. For example:

• Old contact has 10 incidents assigned to ID 100.
• New contact has 0 incidents but wants to own those that the old contact does. Their ID is 105.

In SQL, the following could change the incident ownership:

USE Altiris_Incidents
UPDATE [workitem]
SET Contact_ID = 105
WHERE Contact_ID = 100

Warning: This SQL script should be tested with a non-production database first, or if nothing else, the production database should be backed up before making this sort of change.

However, the above script alone will not be sufficient to "clean up" the database. There are many tables that are associated with a contact ID. Each one would have to be changed in the above manner to ensure that the switch over is complete.

Please Note: Symantec Technical Support is unable to assist in this procedure, as this is not recommended. To obtain support for a SQL-level change of this scope, please engage Symantec Consulting at the following:

Consulting Services (for product implementation and customization)
http://www.symantec.com/business/services/category.jsp?pcid=consulting_services

Related Articles

Duplicate contacts or workers are found in Helpdesk 6
http://www.symantec.com/business/support/index?page=content&id=TECH162530

Changes made to a Helpdesk worker or contact are later reverted back
http://www.symantec.com/business/support/index?page=content&id=TECH154835

How do Helpdesk associations between contacts and assets interact when synced with the Notification Server?
http://www.symantec.com/business/support/index?page=content&id=HOWTO5742

How the Name field is populated for a contact in Helpdesk
http://www.symantec.com/business/support/index?page=content&id=HOWTO42520

Error "The NT account is already used by another contact." occurs while trying to create or edit a Helpdesk contact
http://www.symantec.com/business/support/index?page=content&id=TECH163194