Disable OID user account

I am new to OID, but very familar with Novell eDirectory and Microsoft Active Directory.
Both Novell eDirectory and Microsoft Active Directory have the ability to disable login accounts so they can not be used for login (ie say when a user leaves your company).
I have been unable to find in OID how to disable a user account, could someone point me to that please?
B

there is an attribute called "orclisenabled" and you can disable a user by setting this attribute to "Disabled"

Similar Messages

Disable OID User account after 90 days of inactivity - OIM

Hello there,
I have a requirement where I have to disable a users account if he/she has not logged in since last 90 days into our environment(OID). The users are authenticated via OAM when they are logging in. Does anybody has any idea which attribute in which object class in OID needs to be checked for the last login attempt made by the user and what is the datatype of the same? Is it a date that I can compare after making a initial LDAP context to OID and pointing to each single user?
Really need a solution for this. Please respond.
Many Thanks,
- oidm.

Check the schema description at:
http://download.oracle.com/docs/cd/B28196_01/idmanage.1014/b25348/schema.htm#CFHCGFCC
You create a code that runs daily, check for the last login dates and, if is older than 90 days, you disable the OID user.

How to temporarily lock or disable a user account

Hi, I need help on the easiest way to do the following:
I want to temporarily disable one of the user accounts on my Mac so it cannot
be used.
I do not want to delete the account, just block it
Thanks

Aha! Now that's the kind of info I was looking for.
To hide the user with short user name "jim" from the login window, first log in to an admin account, launch Terminal, and paste in these two lines:
sudo defaults write /Library/Preferences/com.apple.loginwindow \
HiddenUsersList -array-add jim
To unhide the account, enter this:
sudo defaults delete /Library/Preferences/com.apple.loginwindow \
HiddenUsersList

How to disable guest user account on iMAC

I upgraded to Lion and now I have a guest user account on the log in screen. I want to disable this account. How do I get rid of it?

System Preferences > Users & Groups > Guest User (you may need to authenticate) and uncheck "Allow guests to log in to this computer".

OIM Disable OID Users Error

Hello
WHen disabling users in OIM, the connected OID resource is not disabled and I receive the below error in the log. Is there a status definition or lookup that needs to be filled in for this to complete?
2012-06-28 11:30:10,048 INFO [STDOUT] Target Class = com.thortech.xl.integration.OID.tcUtilOIDUserOperations
2012-06-28 11:30:10,142 ERROR [XL_INTG.OID] ====================================================
2012-06-28 11:30:10,142 ERROR [XL_INTG.OID] com.thortech.xl.integration.OID.tcUtilOIDUserOperationsMapping for ldapdisabled missing in the lookup definition
2012-06-28 11:30:10,142 ERROR [XL_INTG.OID] ====================================================
Thanks
Nick

Have you changed your OID user process task mappings for the Enable User and Disable User tasks? By default these set AttrName to "UserEnabled" and "UserDisabled", both of which map in lookup AttrName.Prov.Map.OID to attribute orclIsEnabled.
Your error messages seems to suggest your Disable User process task mapping for OID User has been set to have AttrName set to ldapdisabled, and this attribute does not have a mapping defined in AttrName.Prov.Map.OID.

How to disable a user account and issue CoA via REST? (ACS 5.4)

Like the subject line says, I need to disable user accounts via REST, as well as issue CoA doing the same. Is this even possible? I've been trying for a few days now and I can do GET queries on user accounts, but I can't get anything to work using PUT.

According to this document it should be possible to use the PUT method.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/sdk/rest.html
Could you please tell us how are you using the PUT method? I could try to replicate it in my lab.
Best regards

Help disabling expired user accounts in AD

I'm looking for a bit of help here... I'm trying to create a vb script that looks for all user accounts that has expired before today and disables them. After a
LOT of scrounging the interwebs I've been able to scraped together the bellow VB script that lists all the expired user accounts that are still active, so now i'm trying to have it take the found
accounts and disable them
Option Explicit
Dim dtmAdjusted, lngSeconds, str64Bit
Dim objShell, lngBiasKey, lngBias, k
Dim objRootDSE, strDNSDomain, objConnection, objRecordset, objUser
Dim strBase, strFilter, strAttributes, strQuery, strDN, strAttributes1, strAttributes2, strAttributes3
' Obtain local Time Zone bias from machine registry.
Set objShell = CreateObject("Wscript.Shell")
lngBiasKey = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _
& "TimeZoneInformation\ActiveTimeBias")
If UCase(TypeName(lngBiasKey)) = "LONG" Then
lngBias = lngBiasKey
ElseIf UCase(TypeName(lngBiasKey)) = "VARIANT()" Then
lngBias = 0
For k = 0 To UBound(lngBiasKey)
lngBias = lngBias + (lngBiasKey(k) * 256^k)
Next
End If
' Convert current date/time value to UTC.
dtmAdjusted = DateAdd("n", lngBias, Now)
' Find number of seconds since 1/1/1601.
lngSeconds = DateDiff("s", #1/1/1601#, dtmAdjusted)
' Convert the number of seconds to a string
' and convert to 100-nanosecond intervals.
str64Bit = CStr(lngSeconds) & "0000000"
' Determine DNS domain name.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
' Use ADO to search Active Directory.
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objRecordset = CreateObject("ADODB.Recordset")
objRecordset.ActiveConnection = objConnection
' Search entire domain.
strBase = "<LDAP://dc=globalgiving,dc=local>"
' Filter on expired user accounts.
strFilter = "(&(objectCategory=person)(objectClass=user)" _
& "(accountExpires<=" & str64Bit & ")(!accountExpires=0)(!userAccountControl:1.2.840.113556.1.4.803:=2))"
' Retrieve Distinguished Names.
strAttributes = "sAMAccountName"
' Use ADO to query AD.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
objRecordset.Source = strQuery
objRecordset.Open
' Enumerate expired user accounts.
Do Until objRecordSet.EOF
strDN = objRecordSet.Fields("sAMAccountName")
Wscript.Echo strDN
objRecordSet.MoveNext
Loop
' Clean up.
objRecordset.Close
objConnection.Close
Set objRootDSE = Nothing
Set objConnection = Nothing
Set objRecordSet = Nothing
I tried adding:
strDN.AccountDisabled = True
strDN.SetInfo
but I get :
(66, 1) Microsoft VBScript runtime error: Object required: 'jtest'
jtest is one of the test accounts I have on my AD.
Any suggestions or pointers anyone can give me? I found a 4 line power script that dose exactly what i want, but power script isn't an option for me :(

Start with this:
'change this
' Retrieve aDS path to user object
strAttributes = "aDSPath,sAMAccountName"
' Enumerate expired user accounts.
Do Until objRecordSet.EOF
Set account = GetObject(objRecordSet.Fields("aDSPath"))
Wscript.Echo account.SamAccountName
account.AccountDisabled = True
account.SetInfo
objRecordSet.MoveNext
Loop
¯\_(ツ)_/¯

Disables AD User account in OIM 9.1 still user can access its account

The following issue is happing on OIM Version: 9.1.0.1866.25
When disabling a single AD resource, it will appear on IdM in status as Disabled, even though it remains accessible by the user. No change of password occurs.
Where should I check and how can I fix that.
Kind Regards,
Silviu

What task is attached to Disable of user? Ideally we have an adapter attached to disable user who disables user in target AD system when fired. Login to design console, open you process definition and open disable user task to see what adapter is attached.
regards,
GP
Edited by: Gyanprakash Pandey on Feb 2, 2012 4:33 AM

OIM 10G OID user account / group membership reconciliation

Hello
I have an OID environment that is used for OAM access to applications within the environment. I need to be able to reconcile users from OID into OIM along with their group membership so that roles for users are maintained and updated. I have ORM integrated within the environment so entitlements would need to flow to orm to document that users are members of a role / OIM group. Not sure if this is possible through the trusted reconciliation or if there is a user / group target reconciliation that can be used for this. Any help you can give for this would be appreciated.
Thanks

When i use ADCS timestamp as 0 (to capture changes from the beginning and not necessarily after the group change event occured on the AD side) and run AD user target recon this is getting updated. Is this correct and if so how can i always default ADCS timestamp as 0 in the scheduled task and are there any side effects for this sort of approach.
Prasad.
Edited by: Prasad on Nov 7, 2011 12:31 PM

Disable a User Account WITHOUT Deleting It???

Is there a way to disable an account without deleting it?

Yep. When you choose to delete an account you will be prompted whether to delete it immediately or save it to disc image file.

Disabling user account after 24hrs

Hi all.
We have a requirement to disable new user accounts if they are not logged into within 24hrs of creation, I suspect this can be done with some Powershell however I can't really think how.... Any ideas?
Cheers :)

Hi there,
This should get you started.
$when = (get-date) - (new-timespan -days 5)
Get-ADUser -properties created,lastlogondate -filter { created -gt $when } | ? { $_.lastlogondate -eq $null }
It's not a perfect answer to your question but it should get you in the right direction.

Automatically disable user accounts after specific number days Oracle Apps

Hi All,
Is there a way, using group policy or any other method to automatically disable a user account if it hasnt been used (ie,, no has logged on using that account) after a certain amount of days??
This is something I would like to apply enterprise wide, so setting expiry dates on each users object is out, and obviously I only want to apply this to inactive accounts.
Thanks in advance
Saquib

Saquib,
There is no such profile option. However, you can write a code to check LAST_LOGON_DATE in FND_USER table and based on this you can disable/lock the account.

How to disable a local user account ?

Does someone know that ?
Thanks in advance,
p.a

Hey p.a., thanks for the info. I did a little research myself and found two documents by Apple which deal, besides others, with this. Just want to share these info for future reference: 1) [Mac OS X Server User Management|http://images.apple.com/euro/server/macosx/docs/UserManagementv10.5.mnl.pdf] and 2) [Mac OS X Server Command-Line Administration|http://images.apple.com/server/macosx/docs/CommandLine_Adminv10.5.pdf].
I quote from the first (p.60).
*Disabling a User Account*
To disable a user account, you can:
--> Deselect the “User can access account” option in the Basic pane in Workgroup Manager.
--> Delete the account.
--> Change the user’s password to an unknown value.
--> Set password options to disable login. This applies to user accounts with the password type Open Directory or Shadow Password.
From the Command Line
You can also disable a user account using the dscl and pwpolicy commands in Terminal. For more information, see the users and groups chapter of Command-Line Administration.
I prefer the method via Workgroup Manager as part of the [Server Admin Tools|http://www.apple.com/support/downloads/serveradmintools1053.html]. There was some disagreement on whether the Workgroup Manager works on a client version machine some time ago, but I can confirm that it works really well on clients, too. (Hint: To start the Workgroup Manager for a local computer, type "localhost" as address - without the quotation marks.)
And again, the guide for Command-Line Administration states (p.106):
*Preventing a User from Logging In*
Sometimes it is necessary to revoke a user’s ability to access the computer. This involves preventing the user from logging in and then terminating the user’s processes. The latter can be done by forcing the user to log out and then killing remaining processes, or by just killing the user’s processes.
To prevent a user from logging in:
Disable the user account by entering the following command:
$ pwpolicy -a diradmin -u ajohnson -setpolicy “isDisabled=1”
Replace ajohnson with the short name of the user account and replace diradmin with the short name of your domain administrator account.
Note: The pwpolicy command only works for LDAP/Password server users. For a local user, use Workgroup Manager or the Accounts pane of System Preferences.
Regards,
floba
(MN428)
Message was edited by: floba

Scheduled disabling of particular user accounts

Recently, I've become concerned with my daughter's computer use. Is there a way of locking her out of the computer/disabling her user account at a scheduled time every night, for example 9PM to 6AM the following morning? A friend of mine suggested writing an applescript (though I am completely unfamiliar with it) to insert ;disableduser; in NetInfo Manager, or some perl alteration called pwpolicy, but I have no idea what he is talking about. Is it even possible to do what I want? And if so, can somebody dumb it down so I can execute it on my computer?
Mac OS X (10.4.3)

Hi,
You may use "Extended Job Selection" SM 37 to filter on jobs.
I hope it will help.
Thanks,
S

Disable User Account Icon

I want to disable the user account icon (circled yellow in the attached image) which is visible on pressing windows key after user log on.
Let me know how to disable this for a single user using registry.
Thank You,
Sagar

Hi,
I don't think this is possible. As this is by design.
Besides, if you want to disable the user account picture, we might follow the below steps:
Go here: C:\ProgramData\Microsoft\User Account Pictures
Rename user.bmp and guest.bmp to user.ren and guest.ren respectively. (The suffix actually doesn't matter - Just chose ren (stands for 'renamed')
Reboot
Best regards
Michael Shao
TechNet Community Support

Disable OID user account

Similar Messages

Maybe you are looking for