ADAM disable user setADAMAttributesInLDAP(): null=testadamuser001

Hi All,
I get the following problem when running disable user
ADAM disable user setADAMAttributesInLDAP(): null=testadamuser001
instead of CN = testadamuser001
I am faced with null=testadamuser001
Any Ideas/Comments why this happens.
Thanks in advance.
Find the full stack trace available
Regards,
Vinod
Running Disable ADAM User
tcUtilADTasks::disableADAMUser() Enter
tcUtilADTasks::getObjectByObjectGUID() Enter
tcADUtilLDAPController::search() Enter
tcADUtilLDAPController::getPath() Enter
tcADUtilLDAPController::getPath() Exit
tcADUtilLDAPController::connectToAvailableAD() Enter
tcADUtilLDAPController::hashTableEnvForDirContext() Enter
tcADUtilLDAPController::hashTableEnvForDirContext() Exit
tcADUtilLDAPController::hashTableEnvForLDAPContext() Enter
tcADUtilLDAPController::hashTableEnvForLDAPContext() Exit
tcADUtilLDAPController::validateCertificates() Enter
tcADUtilLDAPController::validateCertificates() Exit
Critical Extensions Supported
tcADUtilLDAPController::invalidateSSLSession() Enter
tcADUtilLDAPController::invalidateSSLSession() Exit
tcADUtilLDAPController::connectToAvailableAD() Exit
tcADUtilLDAPController::disconnect() Enter
tcADUtilLDAPController::disconnect() Exit
tcADUtilLDAPController::search() Exit
tcUtilADTasks::getObjectByObjectGUID() Exit
tcADUtilLDAPController::getCanonicalName() Enter
tcADUtilLDAPController::removeOrgFromRootContext() Enter
tcADUtilLDAPController::removeOrgFromRootContext() Exit
tcADUtilLDAPController::getCanonicalName() Exit
tcUtilADTasks::checkHierarchy() Enter
tcUtilADTasks::checkHierarchy() Exit
tcADUtilLDAPController::getAttributeValues() Enter
tcADUtilLDAPController::getPath() Enter
tcADUtilLDAPController::getPath() Exit
tcADUtilLDAPController::connectToAvailableAD() Enter
tcADUtilLDAPController::hashTableEnvForDirContext() Enter
tcADUtilLDAPController::hashTableEnvForDirContext() Exit
tcADUtilLDAPController::hashTableEnvForLDAPContext() Enter
tcADUtilLDAPController::hashTableEnvForLDAPContext() Exit
tcADUtilLDAPController::validateCertificates() Enter
tcADUtilLDAPController::validateCertificates() Exit
Critical Extensions Supported
tcADUtilLDAPController::invalidateSSLSession() Enter
tcADUtilLDAPController::invalidateSSLSession() Exit
tcADUtilLDAPController::connectToAvailableAD() Exit
tcADUtilLDAPController::getAttributeValues() Exit
tcADUtilLDAPController::setADAMAttributesInLDAP() Enter
tcADUtilLDAPController::getPath() Enter
tcADUtilLDAPController::getPath() Exit
tcADUtilLDAPController::connectToAvailableAD() Enter
tcADUtilLDAPController::hashTableEnvForDirContext() Enter
tcADUtilLDAPController::hashTableEnvForDirContext() Exit
tcADUtilLDAPController::hashTableEnvForLDAPContext() Enter
tcADUtilLDAPController::hashTableEnvForLDAPContext() Exit
tcADUtilLDAPController::validateCertificates() Enter
tcADUtilLDAPController::validateCertificates() Exit
Critical Extensions Supported
tcADUtilLDAPController::invalidateSSLSession() Enter
tcADUtilLDAPController::invalidateSSLSession() Exit
tcADUtilLDAPController::connectToAvailableAD() Exit
tcADUtilLDAPController::modifyAttributes() Enter
The error occured in tcADUtilLDAPController::modifyAttributes():[LDAP: error code 32 - 0000208D: NameErr: DSID-031001E4, problem 2001 (NO_OBJECT), data 0, best match of:
    'OU=OU-XXXXX,OU=YY,DC=XXXXXXX,DC=PP,DC=MM'
ERROR,27 aug 2009 07:43:15,231,[OIMCP.ADCS],The error occured in tcADUtilLDAPController::setADAMAttributesInLDAP():
null=testadamuser001
doesn't exists:[LDAP: error code 32 - 0000208D: NameErr: DSID-031001E4, problem 2001 (NO_OBJECT), data 0, best match of:
    'OU=OU-XXXXX,OU=YY,DC=XXXXXXX,DC=PP,DC=MM'
tcADUtilLDAPController::disconnect() Enter
tcADUtilLDAPController::disconnect() Exit
AD User disable operation failed:Connection Error
tcUtilADTasks::disableADAMUser() Exit

Hi Saggu,
I checked all the look ups and they seem to be fine.
I am using 9101 connector of AD.
Lookup definition for AD.Parameter is as follows
MultiValueAttributes     memberOf
MultiValueAttributesConfiguration     ,
UserObjectConfiguration     |
LdapUserObjectClass     user
LdapGroupMember     member
LdapUserDNPrefix     cn
Pagesize     100
I am clueless as to why or where from null comes in. Create Delete and other operations are working fine.
Ive even checked AtMAP.ADAM and it looks ok.
Regards,
Vinod

Similar Messages

Disable Inbox Rules for Disable Users

I have found that when our helpdesk disables an AD user account (terminated employee) that has an Outlook inbox rule to forward the email to an email address outside the organization, emails sent to the former employee are still forwarded to that outside
email address. I would like to run a script each day that queries AD for all disabled accounts, removes any forwarding SMTP adresses, then removes all mailbox inbox rules. I have been trying to use get-aduser against a DC and export the list of
disabled users, this works fine. I then take that csv, import it and use -foreach-object to set the forwarding smtp address to null. I would then like to use the same csv file to run the -removeinbox rule command against the list. I am having
a hard time time combining the commands I need into a PS script that works against both AD and Exchange.
Anyone have some powershell kung fu to assist me? Thank you!
~Eric

Hi Eric,
According to your description, I understand that you want a script to get a list of disabled AD user, then removes any forwarding SMTP addresses, then removes all mailbox inbox rules.
We can run following command to get a list of disabled AD user in PowerShell:
Get-ADUser -Filter 'Enabled -eq "false"' | select name,userprincipalname
More details about “How Can I Get a List of All the Disabled User Accounts in Active Directory? “, for your reference:
http://blogs.technet.com/b/heyscriptingguy/archive/2005/05/12/how-can-i-get-a-list-of-all-the-disabled-user-accounts-in-active-directory.aspx
Also, run below command to disable forwarding SMTP address and inbox rule:
Get-Mailbox -Identity xxxx | Set-Mailbox -DeliverToMailboxAndForward $false
Get-InboxRule –Mailbox xxxx | remove-InboxRule
However, we recommend use this disable AD user to disable mailbox.
By the way, this question will related to the script of Exchange server, please contact relevant team so that you can get more professional suggestions. For your convenience:
http://technet.microsoft.com/en-us/scriptcenter/dd742246.aspx
Best Regards,
Allen Wang

Unable to find disabled users

I used the below to search for all disabled users in the system. I have a disabled user in IDM but the queryResult is null in the log file. Do you have any ideas?
<Action id='0' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='queryObjectNames'/>
<Argument name='type' value='User'/>
<Argument name='attributes'>
<map>
<s>dis</s>
<s>true</s>
</map>
</Argument>
</Action>
dis is in the <QueryableAttrNames> list already. It's one of the predefined attributes in this list. I did not add it in.
Thanks

I found the answer. I found it in the WFs, Forms and Views documentation for 7.1. This will find all users who are either disabled or partially disabled.
<Action id='0' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='queryObjectNames'/>
<Argument name='type' value='User'/>
<Argument name='single' value='false'/>
<Argument name='attributes'>
<map>
<s>lhdis</s>
<s>true</s>
</map>
</Argument>
</Action>
What I don't understand is lhdis is not defined in the <QueryableAttrNames> list. Below is the <QueryableAttrNames> list out of the box. Only dis but not lhdis. Even though I got the result that I want but I want to know how we can use lhdis when it's not in the <QueryableAttrNames> list???? Anyone knows?
<QueryableAttrNames>
<List>
<String>correlationKey</String>
<String>role</String>
<String>email</String>
<String>name</String>
<String>firstname</String>
<String>lastname</String>
<String>idmManager</String>
<String>prov</String>
<String>dis</String>
<String>locked</String>
<String>user_resources</String>
</List>
</QueryableAttrNames>

Find disabled user in idm side or AD resource?

Any disabled user is moved to disabled accounts OU in AD in our enviroment.
What is the best way to check for any disabled user in a workflow? is this on IDM side or in the disabled user's OU in AD?
If so, what would be the correct attribute to use.
Please suggest?
Thanks for your help.
Edited by: @waveset on Mar 3, 2008 1:10 PM
Edited by: @waveset on Mar 3, 2008 1:14 PM

i am trying to get this value at runtime in a form or rule
i am getting the user object as follows:
<defvar name='thisUserObj'/>
<setvar name='thisUserObj'>
     <invoke name='getObject'>
          <new class='com.waveset.server.InternalSession'/>
          <invoke name='findType' class='com.waveset.object.Type'>
               <s>User</s>
          </invoke>
          <ref>accountId</ref>
</invoke>
</setvar>
i SHOULD be able to reference the disabled attribute in any of the following ways, but they all return null:
<notnull>
     <select>
<invoke name='getAttribute'>
     <ref>thisUserObj</ref>
     <s>disabled</s>
</invoke>
<ref>thisUserObj.accounts[Lighthouse].disabled</ref>
<ref>thisUserObj.waveset.disabled</ref>
</select>
</notnull>
What am i doing wrong? Any help is appreciated.
Thanks

PS script to disable users / Audit and remove Groups / Hide from GAL have bits but need to put it together

Hi All
I am trying to get a script together to run against a specific OU (our disabled Users OU) to make the process of leavers more automated.
I am trying to achieve the 4 main outcomes below
1. Disable User account
2. Hide from GAL
3. Export users group membership to a file based on SamAccountName
4. Remove users from all groups except domain users
I have some parts of this working from other peoples scripts i have found on the web but need to tie it all together which is proving to be beyond my basic scripting ability
Below is what i have so far, this does disable users / hide from GAL and remove groups however as stated i would really like it to export the group membership to a file before removing them so i have a record should a mistake be made.
$users= get-aduser -Filter {(Enabled -eq "True")} -SearchBase "ou=Disabled Accounts,dc=test2k8,dc=local"
Function RemoveMemberships
param([string]$SAMAccountName)
$user = Get-ADUser $SAMAccountName -properties memberof
$userGroups = $user.memberof
$userGroups | %{get-adgroup $_ | Remove-ADGroupMember -confirm:$false -member $SAMAccountName}
$userGroups = $null
$users | %{RemoveMemberships $_.SAMAccountName}
ForEach ($user in $users)
set-aduser -identity $user.sAMAccountName -Enabled $false -replace @{msExchHideFromAddressLists=$true}
exit
If there is anyone here that can help i would be very grateful
Many Thanks
Nick

Try this:
$Users = get-aduser -Filter {(Enabled -eq "True")} -SearchBase "ou=DisabledAccounts,dc=test2k8,dc=local"
Function Remove-GroupMembership
[CmdletBinding()]
param
[parameter(ValueFromPipeline=$true)]
$Identity
process
if ($Identity -is [string] -or !$Identity.memberof)
$Identity = Get-ADUser $Identity -properties memberof
Write-Verbose -message $Identity.samAccountname
foreach ($Group in $Identity.memberof)
Write-Verbose $Group
Remove-ADGroupMember $Group -confirm:$false -member $Identity
$Users | Remove-GroupMembership -verbose 4> c:\users\mmcnabb\desktop\groups.txt
forEach ($User in $Users)
set-aduser -identity $user.sAMAccountName -Enabled $false -replace @{msExchHideFromAddressLists=$true}
It uses the verbose stream to redirect the groups out to a text file of your choice. Please note this is untested so please use with caution.

Disable User in Postprocess Handler?

Hi,
we try to disable an user account by using a postprocess handler (entity-type="User" operation="CREATE"), because every created user should be disabled by default. (OIM 11.1.1.5)
I use the following code snippet:
UserManager um = this.getUserManager();
// 1. create an empty User object
User userObj = new User(null);
//2. set attribute to identify uniquely the user to modify
userObj.setAttribute("User Login", usr_login);
//3. set attribute to be modified (in this case Display Name).
//userObj.setAttribute("Display Name", userDisplayName);
userObj.setUserDisabled("1");
//4. update the user
//userOperationsService.updateUser(arg0, arg1, arg2);
System.out.println("Disabling user...");
um.modify("User Login", usr_login, userObj);
which gives us the following exception:
<Aug 19, 2012 2:36:15 PM CEST> <Error> <oracle.iam.identity.usermgmt.impl.handlers.modify> <IAM-3050119> <Modify User API cannot change user status.>
<Aug 19, 2012 2:36:15 PM CEST> <Warning> <oracle.iam.platform.kernel.impl> <IAM-0080002> <Orchestration validation failed on the event handler - IAM-3050119:Modify User API cannot change user status.:>
<Aug 19, 2012 2:36:15 PM CEST> <Error> <oracle.iam.identity.usermgmt.impl> <IAM-3050029> <The user cannot be created due to validation errors.
oracle.iam.platform.kernel.ValidationFailedException: IAM-3050119:Modify User API cannot change user status.:
at oracle.iam.identity.usermgmt.utils.UserManagerUtils.createValidationFailedException(UserManagerUtils.java:721)
at oracle.iam.identity.usermgmt.utils.UserManagerUtils.createValidationFailedException(UserManagerUtils.java:751)
at oracle.iam.identity.usermgmt.impl.handlers.modify.ModifyUserValidationHandler.validate(ModifyUserValidationHandler.java:373)
at oracle.iam.identity.usermgmt.impl.handlers.modify.ModifyUserValidationHandler.validate(ModifyUserValidationHandler.java:187)
at oracle.iam.identity.usermgmt.impl.handlers.modify.ModifyUserValidationHandler.validate(ModifyUserValidationHandler.java:174)
at oracle.iam.platform.kernel.impl.OrchProcessData.validate(OrchProcessData.java:217)
at oracle.iam.platform.kernel.impl.OrchProcessData.runValidationEvents(OrchProcessData.java:180)
at oracle.iam.platform.kernel.impl.OrchestrationEngineImpl.validate(OrchestrationEngineImpl.java:644)
at oracle.iam.platform.kernel.impl.OrchestrationEngineImpl.process(OrchestrationEngineImpl.java:497)
at oracle.iam.platform.kernel.impl.OrchestrationEngineImpl.orchestrate(OrchestrationEngineImpl.java:444)
at oracle.iam.platform.kernel.impl.OrchestrationEngineImpl.orchestrate(OrchestrationEngineImpl.java:378)
at oracle.iam.identity.usermgmt.impl.UserManagerImpl.modify(UserManagerImpl.java:899)
at oracle.iam.identity.usermgmt.impl.UserManagerImpl.modify(UserManagerImpl.java:974)
at oracle.iam.identity.usermgmt.api.UserManagerEJB.modifyx(Unknown Source)
I have also tried other API calls (e.g. UserManager.disable()), but that also resulted in Exceptions.
Is it possible to disable users that way?
How can this be achived?
Thanks in advance,
Florian

Some additional information:
OIM / LDAP Sync seems to accomplish an LDAP search operation and then decides user is already there ... No modify operation on LDAP.
[2012-08-23T09:19:48+02:00] [OID] [TRACE:16] [] [OIDLDAPD] [host: idmhost] [pid: 3157] [tid: 8] [ecid: 004lyajFIOqDkZWFLzYROA0000lL0000ds,0] ServerWorker (REG):[[
BEGIN
ConnID:7285 mesgID:105 OpID:104 OpName:search ConnIP:192.168.2.111 ConnDN:cn=oimldap,cn=systemids,dc=secaron,dc=com
orclinmemFilter:
Orig Filter(numAVAFilters=2):(&(cn=wwwww eeeee)(objectclass=inetorgperson))
Removed Filter: (objectclass=inetorgperson)
New Filter(numAVAFilters=1):(cn=wwwww eeeee)
2012-08-23T09:19:48 * INFO :gslfseADoSearch BASE = cn=Users,dc=secaron,dc=com FILTER = (cn=wwwww eeeee) #REQDATTR = 4 SCOPE = 1 REQDATTRS = cn orclguid cn objectclass
TIMELIMIT = 3600 SIZELIMIT = 0 DEREF = 3
2012-08-23T09:19:48 * gslfbpsParsePagingCtrlValue: exit with status = 0 pagesize = 1
2012-08-23T09:19:48 * INFO:gsleswrASndResult OPtime=1570 micro sec RESULT=0 tag=101 nentries=1
END
]]

Getting error "1013009 Administrator Has Temporarily Disabled User Commands

Hi All,
I am getting the error"1013009 Administrator Has Temporarily Disabled User Commands" while executing a report script in Essbase 11.1.1.3
Appreciate any help..
Thanks
Mahesh

Mahesh wrote:
Hi All,
I am getting the error"1013009 Administrator Has Temporarily Disabled User Commands" while executing a report script in Essbase 11.1.1.3
Appreciate any help..
Thanks
Mahesh
Possible Cause
When a database is being restructured or any application/database on the server is being copied, you can get this message.
or
When a cube is being restructured, commands are restricted because the integrity of the cube has to be stable and no one is allowed to access it.
or
Copying an application requires that the Essbase security file be in read/write mode and therefore other applications are not accessible until the process is completed.
Possible Solution
In Application Settings, verify that the Allow Commands or Allow Updates options are not selected.
If not selected select those..and try
Regards,
Prabhas
Edited by: P on Apr 7, 2011 3:36 PM
Edited by: P on Apr 7, 2011 3:38 PM

Outlook Contact Card - Organization Tab disabled users

In Outlook there is a Contact Card showing detailed information about that person. the Organization tab shows the contact's "Manager", "Shares Same Manager" (other contacts with the same manager), and "Direct Reports" (people
that report to that contact).
The problem i am seeing is that Users disabled in Active Directory (people that have left the company) are showing up in the Organization Tab.
How can i filter out disabled users from this list for anyone using Outlook?
I cannot permanently delete users from Active Directory until after a disabled account reaches a certain age. Also i would prefer not modifying the disabled Active Directory user accounts.
We mostly run Outlook 2010 with a few people running Outlook 2013

Hi,
Outlook has no control over this, it just displays what it got from the server end. And to my knowledge, there is no such a feature to filter out those users from that list, at least on Outlook client.
Regards,
Ethan Hua
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

How to do Archiving of deleted & disabled users in OIM11g

Hi All,
As per the requirement we have to do archive of deleted & disabled users in OIM11g(11.1.1.2) after 75days. Can i know how can i achieve this?
Regards,
user7609

Just to recap:
Your client requirement is to archive users out of OIM after 75 days. This means in addition to actually disabling and/or deleting them, fully removing any traces of them from the system.
As Kevin & GP said, OIM is just not built to do this. API alone is not going to accomplish this task... you'll also need to include SQL to actually drop data out of tables.
All that being said, your post said the reason for this was because of a "license for limited users". Oracle Identity Manager is licensed on an active user basis. You really should talk with your Oracle rep to confirm, but I've never had licensing contracts include deleted/disabled users.

Disabling User in Solaris

Is there anyway to change the way the resource adapter for Solaris and Linux disables users so that it uses the native lock provided through passwd rather than setting a random password?
Scott

Is there anyway to change the way the resource
adapter for Solaris and Linux disables users so that
it uses the native lock provided through passwd
rather than setting a random password?No there is no way to do that.
The usage of passwd -d and or -l is limited to certain installations. If you read the man page for passwd you will see that it only works for files as the repository not for any of the other possibilities (NIS or NIS+ or ldap). It also depends on PAM modules to implement this and they do not have to be configured on the system.
WilfredS

Disabled User Password should not be changed

Hi,
We have a requirement that only if the user's status is active, then only administartor must be able to change the user password. Admin should not be able to change the password if the user is in disabled state/locked state.How can we achieve this?please sugest...
Regards
Vinoth

Hi,
We have made an entity adapter which is taking usr login value from User[in Data object manager] and calling our java method which is making connection to OIM database and getting us the status of user.
Now if the status of user is disabled method is returning true and on true we have associated our error code to it.
We are executing our entity adapter in pre-update execution.
Now when we are changing password of any disabled user we are able to see our error code. But what ever update [either first name update, enable] we are running on that user same error code is appearing.
Plesae suggest/reply.
thanks

Disable User on updating an User attribute in OIM

Hi,
I have OIM 11g R2 with LDAP SYNC enabled with OID through OVD.
I want to trigger Disable user on modifying an UDF attribute of user.
Like if attribute1 of user is set to true then disabke user operation should be triggered for the user.
So first in my adapter i will check whether attribute is true and then trigger disable user.
In 11g R2 as mapping adapters attached to Users form in dataobject manager is not supported i am not able to map to the userdefinition and hence not able to check if attribute1 is true or false.
Please help and let me know if this can be achieved in any other way.
Edited by: 988070 on Mar 20, 2013 3:55 AM

You can write a post process event handler:
It will update the user status to disable when UDF attrtibute is set to true.
For this, you need to set the condition as:
Get the value of user defined attribute and store it in a variable "flag".
disable UserManagerResult disable(java.lang.String attributeName, java.lang.Object attributeValue) //attributeName will be user defined fieldm value will be "true"
throws ValidationFailedException,
oracle.iam.platform.authz.exception.AccessDeniedException,
UserDisableException,
NoSuchUserException,
SearchKeyNotUniqueException
Disables the user account matching the search criteria.
Parameters:
attributeName - - The attribute name for the search criteria.
attributeValue - - The attribute value for the search criteria.
Returns:
UserManagerResult containing the entity id of the disabled user.
Cheers,
Vamsi.

OIM-DBAT ...ERROR during Disabling user

Hi,
I am using database app tables connector with OIM, wherein the user is being provisioned to a database table. When user is Disabled, the assosciated database resource does not gets Disabled, Disable User is rejected and It gives following error:
GCPROV.ProvTransportProvider.DBProvisioningTransport.DB_STATUS_FIELD_LOOKUP_ERROR" does not correspond to a known Response Code. Using "UNKNOWN
The table has some attributes viz. Username, user id, fname, lname, Status(can be 0 or 1), email.
The requirement is: when user id terminated in OIM, the respective database resource should get Disabled, that is the status should be updated to 0.

Hi Sunny,
When I disable OIM user , Disable User process of the database account is invoked but it gets rejected giving the above stated error. And the status field in process form is not updated. In the GTC configuration, I have mentioned the table column name(ENABLED,which can take values 0 or 1) that will be acting as status ,and also provided the Lookup code name that contains the status mappings as follows:
Code Decode
Active 0
Disabled 1

Remove GrantSendOnBehalfTo disabled user accounts - A novice at scripting

Hello. Can anyone help please
In our exchange 2010 environment we have users who are granted send on behalf to access. Obviously some users leave and I m finding that there are ghosts left behind which are causing issues with our team who add users into the grantsendonbehalfto
option using the EMC. Using the log view we coy out the command and then remove the disabled user from the command and then paste this into an Exchange Powershell command line. This wrks because it is doing what Exchange EMC does which is rewrites
the -GrantSendOnBehalfTo option in it new entirety.
The problem occurs because I need to remove these en-mass from approx 700 plus accounts.
I have tried to modify one user in order to get the script to work but it doesn't.
This is the error message that happens when I run the script below against a known account with at least 2 disabled users in:-
Couldn't find object "xxxxxxxx.xx.xxxxxxx.xxx.xx/DisabledUsers/2013-08/Gaynor Collins-Punter". Please make sure that i
was spelled correctly or specify a different object. Reason: The recipient xxxxxxxx.xx.xxxxxxx.xxx.xx/DisabledUsers/2
13-08/Gaynor Collins-Punter isn't the expected type.
+ CategoryInfo : NotSpecified: (:) [], ManagementObjectNotFoundException
+ FullyQualifiedErrorId : F6498844
+ PSComputerName : ex02-0029.xx.xxxxxxx.xxx.xx
Am running the script from my local PC
This is the script I have used.
# Gather info use get-mailbox -resultsize unlimited$mailboxes = Get-Mailbox zplew1
Foreach($mailbox in $mailboxes)
for($i = ($mailbox.GrantSendOnBehalfTo.count)-1; $i -ge 0; $i--)
$address=$mailbox.GrantSendOnBehalfTo[$i]
$addressString=$address.addressString
If($addressString -like "*disabled*")
$mailbox.GrantSendOnBehalfTo.removeat($i)
$info >> "C:\Scripts\grantsendonbehalfto.csv"
$mailbox |set-mailbox -GrantSendOnBehalfTo $mailbox.grantsendonbehalfto
}If you requiere any more info please let me know.

#1 - I recommend posting in xchange forum fo rhow to do this
#2 - Wen an account is disabled most on the information in the object is hidden. YOu would need to undelete to use the object.
#3 - Get list as text and validaye al values are not deleted accounts. Remove deleted and save back.
¯\_(ツ)_/¯

How to catch rollback in Disable user process task in Xellerat User Process

hi ...
I want to send an email to manager group of the user, once the user is disabled from the OIM (when end date is reached). I created an adapter and attached it to the ‘Changed User Disabled’ process task in the ‘xellerate user provisioning’ process and add a new row in the “Lookup.USR_PROCESS_TRIGGERS” Lookup definition. (code key: USR_DISABLED and Decode: Change User Disabled ). This adapter executes only when the user status is equal to “disabled”.
This works correctly when the OIM user disabling process execute without any errors. But sometimes while disabling the user it gives an error (“resource is not configured properly”) and rolls back everything and make the user active. But at the same time my adapter runs and sends the mail informing user is disabled but yet user is active.
My problem is how can I find or catch rolls back transaction in the “Disable User” process task (which is in “Xellerate User” process”) ??? If I can get to know that a roll back is occurred then I can send a mail to OIM administrator, informing that user disable process is failed.
Can someone please help me to find this..
Thanks in advance :)
Regards,
i.k.

Hi Rajiv,
Error occurs while disabling the user due to resource configuration problems. ( error message is : DOBJ.RESOURCE_NOTCONFIGURED_PROPERLY -- One or more provisioned resource is not configured properly) In this case i know the problem and how to solve it. But what I want to know is in any case if disable process get fail and if things get roll back again, then how can I track that situation and send a mail to OIM Admin(informing the failure) instead of sending a mail to user managers saying that user account has been disabled.
I think now my problem is clear…. Can u please help me to find this.
Regards,
i.k.

ADAM disable user setADAMAttributesInLDAP(): null=testadamuser001

Similar Messages

Maybe you are looking for