Automating removal of Discovered Users from ACS

I use ACS 4.1 on a Windows server that looks up unknown users in Active Directory. Users in AD are in various groups and ACS has these groups mapped to the ACS groups so that users are granted appropriate access to their needs. This has worked well.
I am now seeing that users are are removed from one AD group and added to another group do not have this change reflected in the ACS system. This is because ACS only looks at the AD group for *unknown users*. The user who has moved AD groups was an unknown user, but, upon first logon, that user became a discovered user. From that point forward, only credentials are checked, not group membership.
On the User Setup section in ACS, there is a button to *Remove Dynamic Users*.
I would love to know the following:
1. Is there a way to have ACS check the current group assignment in AD for *Discovered Users*?
2. If not, is there a way to automate the *Remove Dyanmic Users* fucntion? I have used CSUtil in the past but it seems a little cumbersome for this feature in that I had to dump out the users, reformat the output, and then push the deletion back through. I don't recall it making distinctions of known versus discovered users. It just had users names in ACS groups.
Any insights would be greatly appreciated!

Right, I mention that in my original post. But it requires me to go in and do it. Not the automated process I am looking for.
The other approach I mentioned is to script around the CSUTIL command. While it meets part of the automation requirement, it is not very robust and does not do exactly what I am looking for. It also becomes another complex script that I would have to support.
Thank you.

Similar Messages

Remove role or user from position

Hi all,
we are on ECC 6.0; we are using indirect role assignment. We looking for a way to automate the removing of a user (US) or role (AG) from a position (S).
eg. remove user 123456 from position 50000001 and user 654321 from position 50000002 in one shot.
We have found the standard SAP program RHRHDC00 (RE_RHRHDC00 transaction) but is not designed for doing that.
There's another standard program/function or... for solve this matters?
Many thanks.
Massimo

We looking for a way to automate the removing of a user (US) or role (AG) from a position (S).
There is a report called RHGRENZ2 which can be used to delimit specific OM infotypes (like IT1001- Relationships) specifying the end-date and Position ID (Object Type S and Object ID= Position) manually. In your case, I believe IT1001's Relationship A008 and B007 have to be delimited in order to remove a user (US) or role (AG) from a position (S) but this report cannot be run for specific relationship types of IT1001 (atleast I did never find an option to filter based on relationship types).
You can try using report RHRHDL00 to delete IT1001 relationships from PP Database but you should consider the consequences of such deletions and restrict the selection based in infotypes and relationship types carefully.
Alternatively, you can also build a LSMW script to automate the process of mass delimit/deletion of IT1001's relationship types using transaction PP02 (PP01 is not compatible to BDC/background processing)
Thanks
Sandipan

In 10.6, I could remove old YM users from my archive. In 10.7 and 10.8 I cannot find a YM user log. How do I remove yahoo messenger users from my archive?

In OS 10.6, I could locate the log for my yahoo messenger in the Library under Application Support/Logs/_________________ and delete messages AND users from my archive. With OS 10.7 and OS 10.8, I am only able to delete conversations one at a time and unable to delete old users at all. I am also unable to find out where new conversations are stored. Can anyone help? Thanks.

It is likely they're still stored in the same location. However, in Lion and above, Apple has hidden the Library folder by default.
To find it, hold down the option key and select the "Go" menu item, and Library will appear as an option in that list. You can then select it and from there navigate to Application Support/Logs/XXX to delete stuff.

What's the best way to remove inactive iChat users from jabberd2.db?

I'm about to run Autobuddy for users on my iChat server. However, there are several users that are no longer around and I don't want their records showing up in everyone's buddy list.
What's the safest/best way to remove them?
My plan is to use sqlite3 on the command line and use SQL to remove the entries from the "active" table, but I don't know what impact that may have on the rest of the database.
Any thoughts or suggestions?

Never mind...
Thought I had looked through enough threads. Found the following just after posting my question:
/usr/bin/jabber_autobuddy -d [email protected]
Works like a charm.

Removing non-essential users from Oracle

I'm trying to clean up my Oracle installation by removing tablespaces, users and roles that we don't need. The following users all have their accounts expired/locked. Are any of these essential and shouldn't be removed?
ANONYMOUS
CTXSYS
HR
MDSYS
ODM
ODM_MTR
OE
OLAPSYS
ORDPLUGINS
ORDSYS
OUTLN
PM
QS
QS_ADM
QS_CB
QS_CBADM
QS_CS
QS_ES
QS_OS
QS_WS
SCOTT
SH
WKPROXY
WKSYS
WMSYS
XDB
Cheers,
Warren

This looks like an Oracle Applications (i.e., Financials and Manufacturing) database or one with only some modules installed. To be safe, you should repost this to a forum dedicated to Oracle Apps.
If it really is an Oracle Applications database, then don't remove OE, HR, or any other schema that is an Oracle Applications schema. Never remove OUTLN even if you aren't using outlines. If stored outliens aren't used, then you aren't wasting space. So removing it is a waste of time plus it inhibits you from using stored outlines if you need them but forgot that you removed it.

Exclude specific user from ACS logging ?

Hi,
My customer and I are looking for a way to exclude actions/commands logging on AAA servers (ACS) for a single specific user, though logging still goes on for other users as AAA clients on networks devices have been configured with:
aaa accounting commands start-stop tacacs+
I have not found any solution up to now, either on the ACS side, either on the IOS side and aaa commands.
(Though it looks like a potential security issue), can anyone advise?
Thanks for your cooperation.
Yvon.

ACS 5.1 has the concept of collection filters which I think can do what you are looking for
See: http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/viewer_sys_ops.html#wp1072344

Looking for Help with Active Directory Script to Remove a User from msExchDelegateListLink

I'm struggling to put together an Active Directory Powershell script that will remove a specific user from the msExchDelegateListLink.
It looks like Set-AdUser would do the trick. I would want to remove a user in the format of
{CN=Wood\, Sandy,OU=Networking,OU=IT,DC=my,DC=domain,DC=com}
Has anyone succeeded in doing this before?
Orange County District Attorney

I use this:
$user = '<user name>'
$userDN = Get-ADUser $user | select -ExpandProperty DistinguishedName
$delegates = Get-ADUser $user -Properties msExchDelegateListBL |
select -ExpandProperty msExchDelegateListBL
foreach ($delegate in $delegates)
Set-ADUser $delegate -Remove @{msExchDelegateListLink = "$UserDN"}
Never quite got around to putting it into a function.
[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

Removing admin user from planning application

Hi,
i have a small question that possibly u can answer easily.
in workflow process when users click "change status", at promote and approve "admin" user comes up with in combo-box.
we are sharing shared services with another project team so i dont wanna show "admin" to my users in that list cos i have "plnadmin" as application owner.
by the way "admin" was deprovisioned from planning applications on HSS such that he cannot log-in to planning application. (user doesnot exists for this application message.)
but he still exists in workflow process combo-boxes and "Administration->Application Settings->Assign application Owner" combo-box.
how can i remove him ?
thx,
Version: 11.1.1.2

Hi,
In theory it should remove the admin user if they have been deprovisioned and the application owner assigned to another user. I did a quick check on 11.1.1.3 and it removed the admin user from the workflow and tables.
Maybe it has not removed the user because a workflow was already in progress even though it worked for me.
There are probably a number of ways to try and removing the user e.g. try restart planning service and log into the application to see if it syncs up with shared services (it should do if the property SYNC_USER_ON_LOGON is set to true, which is default for planning)
Try stopping the workflow process and run a refresh, or go to access permissions for a member and click migrate identities to see if it clears the table.
Final stage would be to manually remove from the repository tables.
(sorry if I have not covered all areas, I sure somebody will give you different ideas or repeat what I say)
Cheers
John
http://john-goodwin.blogspot.com/

Removing the user from standard task group

Experts,
I need to remove the one user from the standard task "Display MC Document (outbound w/o IDoc)". Since it is a standard task I'm not able to make any changes.
I hope I need to change in the agent which is assigned to this task. But donno how to find the agents assigned to this task.
Please help me in resolving this.
Thanks,
Naveen

Hi Naveen,
If that user assigned as the 'Possible agent' of the task then you can remove the user easily.
In the workflow template, go that activity. Under the Task ID there is a option called 'Agents' and click that icon to open. In the new screen, the possible agents of this task will be displayed.
Select the desired user and delete it.
Thanks,
Viji.

Remove GrantSendOnBehalfTo disabled user accounts - A novice at scripting

Hello. Can anyone help please
In our exchange 2010 environment we have users who are granted send on behalf to access. Obviously some users leave and I m finding that there are ghosts left behind which are causing issues with our team who add users into the grantsendonbehalfto
option using the EMC. Using the log view we coy out the command and then remove the disabled user from the command and then paste this into an Exchange Powershell command line. This wrks because it is doing what Exchange EMC does which is rewrites
the -GrantSendOnBehalfTo option in it new entirety.
The problem occurs because I need to remove these en-mass from approx 700 plus accounts.
I have tried to modify one user in order to get the script to work but it doesn't.
This is the error message that happens when I run the script below against a known account with at least 2 disabled users in:-
Couldn't find object "xxxxxxxx.xx.xxxxxxx.xxx.xx/DisabledUsers/2013-08/Gaynor Collins-Punter". Please make sure that i
was spelled correctly or specify a different object. Reason: The recipient xxxxxxxx.xx.xxxxxxx.xxx.xx/DisabledUsers/2
13-08/Gaynor Collins-Punter isn't the expected type.
+ CategoryInfo : NotSpecified: (:) [], ManagementObjectNotFoundException
+ FullyQualifiedErrorId : F6498844
+ PSComputerName : ex02-0029.xx.xxxxxxx.xxx.xx
Am running the script from my local PC
This is the script I have used.
# Gather info use get-mailbox -resultsize unlimited$mailboxes = Get-Mailbox zplew1
Foreach($mailbox in $mailboxes)
for($i = ($mailbox.GrantSendOnBehalfTo.count)-1; $i -ge 0; $i--)
$address=$mailbox.GrantSendOnBehalfTo[$i]
$addressString=$address.addressString
If($addressString -like "*disabled*")
$mailbox.GrantSendOnBehalfTo.removeat($i)
$info >> "C:\Scripts\grantsendonbehalfto.csv"
$mailbox |set-mailbox -GrantSendOnBehalfTo $mailbox.grantsendonbehalfto
}If you requiere any more info please let me know.

#1 - I recommend posting in xchange forum fo rhow to do this
#2 - Wen an account is disabled most on the information in the object is hidden. YOu would need to undelete to use the object.
#3 - Get list as text and validaye al values are not deleted accounts. Remove deleted and save back.
¯\_(ツ)_/¯

Problem deleting user from Unity Connection 8.5.1 - BulkUserDelete

We are having issue deleting a user from Unity Connection 8.5.1
We tried the command line to remove the user, no go. We also installed the CUC Clean Inconsistency 1.2 and that to did not remove it.
We then tried BulkUserDelete tool and the initiial search in BulkUserDelete see's the problem user (alias) but on the next screen where you select the users, on that step the BulkUserDelete no longer see's the problem user.
Anyone know of other way to remove a problem user from CUC?

Thanks, Rob. I appreciate you taking the time to reply. I feel much more confident about the whole procedure now.
I've read many of your replies to others on this same issue so I'm pretty certain you know what you're talking about. One of the documents I read that made me doubt what TAC said is the document by Saurabh - I've read it through several times already and found it very helpful. Thanks for linking to it.
There's a scheduled back up of UC performed every night (all options are checked). Should I still do a COBRAS backup too or is that unnecessary?
Once the upgrade file installation is complete, do I need to do anything else? From what I've read, this is similar to running a Windows (or Mac) operating system update/patch - start the upgrade file, wait for it to run and once it's complete, reboot the system and continue as usual (assuming everything went OK). Is that right?
Thanks again!
Lisa

How to remove user from custom DLU Group

Hi,
I have created a DLU policy that creates a local user, and places this user
in a custom local group (Group is already present on the system). Now I want
to remove this user from this custom group and place it in another custom
group. I have created a second DLU policy to place the user in the new
custom group. The new custom group is added fine, but the old custom group
assignment also remains. How should I set up the policy so that the user is
removed from the old custom group, or is this not possible?
Regards,
Hen

Hen,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Who removed user from AD Universal secuirty group

Hello , i am trying to find who removed user from universal AD group , i checked audit management policy is enabled but some how event is not getting generated or unable to find those events so please help how to find who did that job - removed the user
from universal security group.
And suppose if anybody is deleting and the logs should be generated on one of the local site Domain controller is that correct ? so anywhere or it can be generated on the member server. Any free third party tool who can help here .
Thanks

Here is another informative technet blog resource that helps to track all the changes made in active directory : http://blogs.technet.com/b/askpfeplat/archive/2012/03/05/how-to-track-the-who-what-when-and-where-of-active-directory-attribute-changes-part-i-the-case-of-the-mysteriously-modified-upn.aspx
If you wish to audit such changes automatically, you may also consider on this automated solution (http://www.activedirectoryaudit.com/) that would be a better approach to audit all the critical changes
into real time and get instant notification for through customized email notification.

Trouble removing a user from creative cloud for teams

I am trying to remove a user from my team, however the X does not show the pop up menu with the option to remove them. Also, when I click on any item on the left hand menu, nothing happens.

Sorry... This is an open forum, not Adobe support... You need Adobe support to cancel a subscription
-start here https://forums.adobe.com/thread/1703848
-or by telephone http://helpx.adobe.com/x-productkb/global/phone-support-orders.html
--and two links which may provide more details, if the above links don't help you
-http://helpx.adobe.com/x-productkb/policy-pricing/return-cancel-or-change-order.html
-http://helpx.adobe.com/x-productkb/policy-pricing/cancel-membership-subscription.html

Cannot remove deleted user from people picker - SharePoint Foundation 2010

So I think I've read all the people picker articles here and I can't find a solution so I thought I'd start a new thread. Here is the issue:
A user was deleted from Active Directory and removed from SharePoint Foundation 2010. The user was still showing in the People Picker within the site collection, so we have performed a few things to try and get rid of this user.
User is deleted from AD
User is deleted from SharePoint Site Collection
Have tried stsadm -o deleteuser
Have removed all mention of this user from UserInfo table
User does NOT show in
https://<SiteCollectionURL/_layouts/people.aspx?MembershipGroupId=0
Cannot find any mention of this user anywhere.
Ran a full crawl as we read on a forum somewhere that it might help.
If I try and add the user back to SharePoint I get "The user does not exist or is not unique"
If I try "stsadm -o deleteuser -userlogin DOMAIN\USER -url https://<sitecollectionurl>" I get "The user does not exist or is not unique"
I am not sure what else I can try now. Can anyone help?
Thanks,
Vinny
Vinny

No other domain trusts that this user could be in.
Just so everyone can stop with the warnings, we do NOT regularly delete users from the UserInfo table and fully are aware of the problems behind it, which is why it is so rarely done. But at times, you have to do what you have to do to help a customer, you
know? This one user is the only one that was removed from the UserInfo table, but there are a few other users that are also deleted (from SharePoint, not manually from UserInfo) that are still showing as well. This one user included.
There MUST be another place that the people picker gets it's information from. ALL of the user's old information still shows in the people picker (username, email address, display name), and yet none of that information exists anywhere other than in the
People Picker. Mailbox is gone from Exchange, User deleted from SharePoint, User deleted from Active Directory. Is there no cache someone could point me towards that People Picker might store information in.
Vinny

Automating removal of Discovered Users from ACS

Similar Messages

Maybe you are looking for