Deprovisioning Task for Deleted User Removes All Members of AD Group

Hello all,
I was wondering if anyone had ever encountered this issue before. We're on 7.1 SP5.
Here's the setup, we have several privileges that are linked to Active Directory Group membership. We have tasks set up to add or remove a user from the membership list of the AD group that are linked to the Provision and Deprovision tasks on the privilege. This has been working very efficiently for us: when a user is assigned the privilege they are added to the group, and when it is removed they are removed from the group. There are no approvals involved.
Recently, we've run into an issue that when a user with a privilege gets deleted from the Identity Store, the Deprovision task gets kicked off, but the user DN that is passed in the LDAP task is NULL. This essentially sets the member attribute on the AD Group to NULL, thus removing all members.
Typically it will throw a warning about deleting obsolete entries and never updates the group. The event tasks seem to be kicked off after the entry is removed from the Identity Store, so it does not seem like a timing issue.
We've had this up and running for several months, but only recently have we had the issue. It does not seem to be restricted to any group, but it will not happen for all the groups. The users in question have had other privileges corresponding to AD group access, but those groups were not emptied.
Any help would be appreciated..
Thanks,
Jared

Matt,
The problem is that this is not being initiated from a task, but form our nightly maintenance job. These users are falling off because of AD updates outside of our system.
If a DN is deleted from AD, it's already been removed from the groups in AD, but the privileges in our Identity Store haven't synced yet. If we strip all privileges before the entry is deleted, and the DN is no longer valid, the event task will bomb because it is trying to remove a user that doesn't exist anymore.
I'm thinking of just trapping it in the jobs with a script that checks that the user DN is not null. If it is, just skip the entry.
And yes, I will be at TechEd.
Thanks,
Jared

Similar Messages

How to remove User IDs for deleted users from the Disk Quota list

Hello,
We have a computer lab setup with an Xserve managing 15 stations in the lab. Users are setup with networked home directories and quota's are setup on the drive containing the home directories to limit users' storage.
The user account and the quota limit are setup with Workgroup Manager. When a student has been gone for a while and we are sure they no longer need the account we delete their account within Workgroup Manager and move their Home folder to the trash.
When viewing disk usage in Server Admin (by selecting the volume and clicking the Quatas tab) user ids for deleted users are listed and it still shows the disk usage and quota settings for the user.
How can I remove theses user ids from the quota list?
Any help would be appreciated.
Brian

I would restore User's file structre back to normal just by copying from standby user?
Did you mean copy files to a new user profile? If so, hope this link can be helpful for you
http://windows.microsoft.com/en-in/windows/fix-corrupted-user-profile#1TC=windows-7
For the unknown user, as you said, it's probably a user account from second OS or
action. If you're annoying about this unknown user, then you can remove all occurrences of granted rights to the specified SID with this command icals [/remove[:g|:d]] <Sid>[...]] [/t] [/c] [/l] [/q]
http://technet.microsoft.com/en-us/library/cc753525.aspx
Yolanda Zhu
TechNet Community Support

Removed all members from SysAdmin on SQL 2000

Aloha
I had a faulty script that unfortunately removed all members from the SysAdmin role. Unfortunately, I cannot reinstall the instance and I only have short windows of opportunity for downtime.
I understand if I can get the database into single user mode and log in I can add a new local account to the database with the sysadmin role, however I can't seem to get logged into the single user mode. It keeps saying "Login failed for user '<MYUSERACCOUNT>'.
Reason: Server is in single user mode. Only one administrator can connect at this time.
I have the SQL agent shut down, I am not running enterprise manager and, as far as I can tell, there are no other admins connecting to the system. I know with newer SQL versions one can limit the single user mode to only accept SQLCMD. Of course, 2000 doesn't
have SQLCMD but has OSQL. Any thoughts on how I can limit the access during this maintenance? I've even tried to remove both named pipes and TCP/IP from the accepted connection types but that didn't seem to make a difference.
Thoughts? Please?

I'm a little rusty on SQL Server 2000. Sorry if this advise is useless.
What account are you using to start the Database Engine. If not networkservice, then connect as that account. Try change the account to a local computer account, and then use that account. The general principal here, is that the account running the database
engine service, can connect.
Rick Byham, Microsoft, SQL Server Books Online, Implies no warranty

Manually execute a povisioning task for a user in OIM 11g

Experts,
In OIM 11g, I would like to execute a resource provisioning task for a user thru OIM admin console.
In OIM 10g, when we select a resource profile for a user, it used to show the list tasks that are executed. There we can add a new task to run manually there.
How to do the same in OIM 11g. in OIM 11g, it is not even showing the lists of tasks executed during provisioning.
Please let me know.

If you are talking about manually adding the provisioning tasks to a user for a particular resource, then you can go to the resource profile of the user, select the particular resource -> click the 'Resource History' button on the right corner and from there you can manually add the tasks.
-Bikash

Can't remove static members using "Manage Group Members"

Using the OAM 10.1.4.2 Group Manager app, I can remove static members from a group by modifying the Member property, but I can't remove members using the "Manage Group Members" page.
When I search for members using that page, I get a list of the current members with an unselected checkbox for each. If I check the box next to a member and click Save, the member is not removed from the group. I turned on trace-level logging and saw that the correct user is being passed to the Identity server to be removed, but I haven't yet found anything to indicate why the removal doesn't work.
Has anyone else run into this issue?
Thanks,
Matthew

Hi Vinod,
I'm running on Window 2003 against a Microsoft ADAM directory. I turned on diagnostics and re-ran the test using both "Manage Group Members" and modifying the property directly-- from what I can tell, the ldap modify only happens when I modify the property.
(I had also noticed the problem with the instructions, but I eventually figured it out-- if I can get this working, I'll have to fix the verbiage before I deploy.)
Any ideas? What platform and directory are you using?
Thanks,
Matthew

How can I set up an SMS group so that all group members can dial a group number and have a text sent out to all members of the group

How can I set up an SMS group so that all group members can dial a group number and have a text sent out to all members of the group
This would be an SMS group similar to an email listserv but running on the SMS network
I have seen private individuals offering this service
It seems strange to me that no internet site like Apple, Yahoo or Google offers this as a free service much as the email group services are free services.
Steve

I think the app GroupMe might do what you want. You might also try contacting your carrier. My carrier offered some fancy group texting service for a while but they never really advertised it so, unless you asked, you never would have known. But, GroupMe is available in the app store. There are lots of other apps that also do group texting but it seems to be the one that gets recommended the most.

Over Quota warning for deleted user

We keep getting, "over quota" warnings for a users that no longer has an account on the mail server. The user has been deleted from the Workgroup and her mailboxes were deleted via command line, but we keep getting over quota warnings. Anyone every seen this? Or know how to make it stop? We're runnning OS 10.4.9.
Connie

Matt,
The problem is that this is not being initiated from a task, but form our nightly maintenance job. These users are falling off because of AD updates outside of our system.
If a DN is deleted from AD, it's already been removed from the groups in AD, but the privileges in our Identity Store haven't synced yet. If we strip all privileges before the entry is deleted, and the DN is no longer valid, the event task will bomb because it is trying to remove a user that doesn't exist anymore.
I'm thinking of just trapping it in the jobs with a script that checks that the user DN is not null. If it is, just skip the entry.
And yes, I will be at TechEd.
Thanks,
Jared

Delete user and all his related data form the relation table

HI All,
I have user and for the user i have 3 more tables with additional fields that relate to the user
the the user is a key on the 3 tables and relate with foreign key .
in case i want to delete the user and i want that all the user data from all the related table will be deleted how can i do that ?
Regards
Joy

HI,
The user is in Z DB tables so i cant delete it with this bapi,
The problem is when i have 4 table and i want to delete the user from them like that :
DELETE FROM: (sv_user_table_name) WHERE userid = iv_user_id,
               (sv_add_fld_table_name) WHERE userid = iv_user_id,
               (sv_att_table_name) WHERE userid = iv_user_id,
               (sv_app_attributes_table_name) WHERE userid = iv_user_id.
IF sy-subrc <> 0.
    RAISE EXCEPTION TYPE .....
if the user are exist in the first and the second table and not in the third and four
i get the sy-subrc = 4 despite the user has deleted from the first and seconed tables
there is nice way to overcome this issue ?
Regards
Joy
Edited by: Joy Stpr on Aug 3, 2009 8:57 AM

Last Logon Date for Deleted Users

Hi,
How can I checked to see last logon date for a deleted user-SAP ECC 6.0?
-Wes

> ... chekcing USR02 the TRDAT field has been reset.
In lower releases you could easily have made a big mistake doing that.
In all releases the security audit log (SM20) is the correct tool for this, but you cannot retro-fit it.
If the SM20 log is not activated for logon events, then there are several other ways of reconstructing parts of the information but they are all incomplete and a big effort.
Cheers,
Julius

Deleted user - Remove link to UserDisp or Person page

Hi,
I'm trying to figure out what removes links from Created By/ Modified By fields for a deleted user?
To elaborate I have a user who no longer exists in LDAP source, so does not exist in UPA and in site collection UserInfo table (tp_Deleted) deleted. When viewing that users documents in SharePoint 2013 - "Modified By" field links to the /UserDisp.aspx
page. If clicked it throws an error message (/_layouts/15/userdisp.aspx?ID=1212). For some other deleted users I'm seeing Modified By field is not linked..which would be ideal. For active users of course it take to the mysite person page.
Is there any job which removes this link? I've waited long enough (weeks) but still running into this issue. Any suggestions would be greatly appreciated!
Many thanks in advanced!
BlueSky2010
Please help and appreciate others by using forum features: "Propose As Answer", "Vote As Helpful" and
"Mark As Answer"

Users who are marked tp_deleted will always remain where referenced elsewhere (e.g. Created By fields). This is to preserve referential integrity. This is standard behavior.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

How to delete the Background job for Deleted user

Dear experts
The User RAMESH was delted before one month
I dont know what job had he Created and Scheduled
where should i find the perticular user backgroung jobs and how to delet it
regards
krishna

From SM37....you can give the user name and find all jobs scheduled by the user
select all jobs>>>>delete
*This should have admin access on jobs
Regards,
Nick Loy

Create approval request for Delete User operati with oim api -11g Release2

Hi,
How I can create an approval request for a User Delete operation usin API? Can anyone quide me? Any help is strongly appreciated..
BR,
Aliye

You can use the exact same technique for any of the other requests submissions through APIs that have been posted on this message forum. Just supply the template name for your request template you plan to use.
Here is a page of sample code for requests. http://java.net/projects/openptk/sources/svn/show/branches/Oracle/OIM11g/examples/java/OIMClient/src/oim/client/request?rev=1402
-Kevin

Lsgrp - list all members of a group

lsgrp is a small and fast utility written in C that does just one thing: it lists the members of a group. It can be used in scripts that need to do something for each user in a group, such as setting up directories or generating per-user configuration files. There is a section on the project page explaining why a new utility was necessary.

I agree, addressing a new message to a group using Address through the Mail program seems to fill in just the first recipient's name.
A work around is to start your new message, click on Address and select the group you wish to send the message to. Take the extra step to highlight the first person in the group and then command-A to select all. When you then click on the To: button all of the recipient's will be in the address line of your mail message.
Alternately, start your new message and then type the name of the group in the To: line (don't use the Address button at all). You don't have to get all of the name typed in before the group name is identified. When the group name has been properly identified just hit the Return key and all of the group members will be filled in the To: line. This should do what you are hoping for.
Dale

How to remove all packages in a group except x, y, and z?

When I installed Arch, I installed KDE. Since then, I've switched to tiling WMs (Awesome, then DWM), and I really have no need of most of KDE any more. I still really like Dolphin, though. Is there a simple way to tell pacman to remove the kde group except for dolphin and its dependencies? (i.e., rather than just removing all of kde and reinstalling the few bits I want.)

Try
#!/bin/bash
groups="kde"
packages="kdebase-dolphin kdeutils-kcalc"
comm -23 <(comm -12 <(pacman -Sgq $groups|sort) <(pacman -Qq) | sort) <(for i in $packages; do pactree -u $i; done | sort)
<thisscriptname> | sudo pacman -Rns -
It allowed me to remove 344 of 396 packages I installed with 'pacman -S kde', both dolphin and kcalc seem to work (they at least start up ;P).
Of course you need to modify which group(s) you want to remove and which packages you want to keep, as well as pacman options - I'm fine with '-Rns' but you may prefer different ones.

Windows updates removes all tabs and tab groups so I have to regularly do a system restore to get them back.

When there is an automatic update from Windows or Microsoft Security Essentials, it regularly has removed all my tabs and tab groups. A very frustrating occurance so I have to do a system restore to get all these back. Any solutions to this issue?

After your computer restarts, you should be able to choose '''[[Session Restore|"Restore Previous Session" from Firefox's History menu]]''' to restore all your tabs and groups from last time.
For this to work, Firefox must be set to remember history in the [[Options window - Privacy panel]].

Deprovisioning Task for Deleted User Removes All Members of AD Group

Similar Messages

Maybe you are looking for