OIM 11gR2 - Push/Pull account locked out information from Active Directory

Question

Hi
At this moment, we are using the default reconciliation method from the Active Directory Connector in OIM 11G R2 to fetch incremental information from AD. This runs every 15 minutes.
However, the customer complains that the time from which the user gets himself locked out due to too many failed login attempts, until it shows up on the OIM account is too long. Worst case, this could be 15 minutes after the user gets himself locked out.
Do anyone have any tips on how we could either push this information from AD-side, or pull this information from OIM more often? Could we create a special scheduled job that just looks for Locked Accounts, and reconciles this each minute?
Best Regards
lloberg

Answer 1

Hi,
Sure, that's definitely possible. You can use the Active Directory cmdlets to retrieve this information. Here's an example of reading input from a text file (just usernames in the text file):
Get-Content .\userList.txt | ForEach {
Get-ADUser -Identity $_ -Properties EmailAddress
You can also read input from a CSV file quite easily. This example assumes a header of Username:
Import-Csv .\userList.csv | ForEach {
Get-ADUser -Identity $_.Username -Properties EmailAddress
Finally, here's a link to the Get-ADUser syntax:
http://technet.microsoft.com/en-us/library/ee617241.aspx
Don't retire TechNet! -
(Don't give up yet - 12,700+ strong and growing)