User Disable

Hello All,
I am using OIM 10g.
If user is disabled in OIM then how we to know timestamp of user disable;
Thanks.

Check CREATE_DATE field from UPA_FIELDS Table for that disabled user

Similar Messages

[OIM 9.1.0.2] Access Policy being evaluated to an OIM user disabled.

Hi Gurus,
I have an Access Policy being evaluated and provisioning resource (AD) to an OIM user disabled.
Any tip on what I should take a look?
Thanks in advance.

Hi all,
I have configured out the XL.EvaluateMembershipForInactiveUser System Property as TRUE, but the membership rule does not get evaluated for disabled users. So the user still remain into the group. I have restarted the OIM.
I need to active the Evaluate User Policies schedule task for this configuration be effective. Or should I do something more?
Thanks a lot.

[OIM 9.1.0.2] RESOURCE NOT REVOKED BY ACCESS POLICY WHEN USER DISABLED

Hi Experts,
OIM Build Number: 1866.62 ( BP15 )
IHAC that faced an unexpected behavior on User disabling.
Some users were associated to groups that had access policies applied.
When those users were disabled, they didnt lose their associated groups and also the resource and permission associated thru access policy applied to those groups.
I saw that there was a bug reported to that issue. So I performed the action plan and set up the XL.EvaluateMembershipForInactiveUser System Property as TRUE. Now after disabling the users are properly removed from groups.
Customer problem: For those users, almost 1000, I did a recon just to estimule the identity, so the membership rule was applied and the groups were removed, but OIM didn't evaluate the access policies and didn't revoke the resources.
I ran the Evaluate User Policies task, and it seems to be stuck. Should the Evaluate User Policies schedule task work for that scenario? Should the resource after running that task be revoked?
Any help would be very appreciated.

Hi Nishith,
I ran the task, but it seems really stuck. It displays the RUNNING status, but any effect is observed. I have to change task status to INACTIVE in the Design Console.
This task has 2 attributes: Batch Size= 500 and Number of Threads=20.
But I have noticed this task in another environment (w/ BP 18 applied), it has 3 attributes: Batch Size= 500 ; Number of Threads=20 and Time Limit in mins=1.
Is it any enhancement for this task in order to improve its performance, or something like that?
What else I can check?
Thanks in advance.

Getting users disabled/deleted with disabled resources in OIM

Hi,
Consider following use case related to OIM:
To get the Users deleted or disabled on a particular date with their 'AD User' resources which are in disabled state.
By means of built in reports i can get the users disabled or deleted for particular date.... how do i get the disabled AD User resource for each user....
i can go for scheduler task but how to proceed on that?

the exact requirement here is to get the users/deleted a day before along with their 'AD User' resources which are disabled
getObjectsByTypeStatus(long plUserKey, java.lang.String psObjectType, java.lang.String psStatus)
Gets a list of all the objects of the specified type that have been provisioned for a user and are in the specified status.
What i can make out here is that:
i need to write some logic that would give users disabled/deleted say yesterday... after this i would loop in these user keys into getObjectsByTypeStatus that would give resources disabled for each user.
Am i correct?
Now how do i get the users disabled/deleted yesterday. This is realised by default Users Disabled/Users deleted report.
But how do i use it in my scheduler
Edited by: Chhavi Saluja on Jun 30, 2010 1:20 AM

CISCO ISE ISSUE 24206 User disabled

Hi there,
We have here an issue with Cisco ISE. When I create a guest account with the sponsor portal We can´t access the Wlan. On tne Cisco ISE Operations \ Authentications returns the error message Event "Authentication" Faulure Reason "24206 User Disabled" Auth Method "PAP_ASCII" Authentication Protocol "PAP_ASCII"
In order to fix this issue, what can I do? I don´t understand why because I can create the user withou error message.
At the sponsor portal the user that I have created doens´t show at the list...
Any help??
Regards
Adriano

Select the affected account and click Reinstate.
It is possible, that your sponsor account does not have the permission to Reinstate/Suspend accounts. Check/change this in your ISE admin page:
- Go to Administration > Guest Management > Sponsor Groups.
- Click the Sponsor Group your sponsor account is a member of to edit.
- Select tab Authorization Levels: view/modify the permission listed for the option Suspend/reinstate Accounts.
ref: https://supportforums.cisco.com/discussion/11431386/ise-guest-user-problem

Problem with users disabling ARD client service

I've got a problem and i'm not quite sure of the work around. I'm a PC guy by nature and can't quite figure this out.
I'm having a problem with users disabling the ARD service from the sharing menu. Unfortunately users need to have admin privleges to do their work so I can't simply give them a standard account.
I've hidden the ARD user account i created from the login window through Netinfo, but I need to find a way to stop users from shutting the ard service down.
They don't seem to understand that the company requires that it be on the computer. Now, I'm the one who is set as the admin for ARD in the building, however we really just use it to rollout drivers, install packages, and its a lifesaver for remotely fixing problems with programs. The company didn't really buy it to spy on the employee's.
Is there any way to hide the service from an admin level account? Or keep them from shutting it down?
BTW, this would have to be done on multiple machines running both panther and tiger.
Any help would be appreciated as I'm not quite sure where to start.

First, as a matter of policy, let them know this service is active, and needs to remain active. If they disobey this instruction and turn it off, you have a human resources issue, not a technical issue.
Second, there are very few enterprise users that need admin access to their machines. Oh, they ALL think they do, and there will be howling when non-admin status is first imposed, but we have 350 users in a publishing environment with less that 20 setup as admins. Those users are almost all superusers who assist others in a technical role.
We have far fewer software problems like this and with ARD, IT can install/ authorize installation of software remotely should a user need that. It simply does not dramatically impact our users to have non-admin access. On the other hand, we recognize that a FEW users will need more access, and grant that on a case-by-case basis.

If user disable cookie how to set and use session with URL Rewritting

if user disable cookie how to set and use session with URL Rewritting by append session ID in url

If cookies are disabled, then app server will automatically try to use URL rewriting for session control. Programmer's responsibility is to encode any links or redirects using
response.encodeURL("/yourPage.jsp")
and
response.encodeRedirectURL("/yourPage.jsp")
See API for details
http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/servlet/http/HttpServletResponse.html#encodeURL(java.lang.String))

User disabled until start date not getting ROs provisioned via AP

Here's the situation: I have a user in OIM that is disabled until start date. When the start date rolls around, and the job "Enable User After Start Date" runs followed by "Evaulate User Policies," the user is correctly enabled and the correct role gets assigned but the access policy associated with that role does not appear to get triggered so the APs resources are not assigned. However, if a user is entered the same way (via HR recon) but is on or after its start date, then the role gets assigned, the access policy fires, and the ROs are provisioned just fine.
I have noticed that if a user is moved from disabled to enabled, then the membership rules fire and any roles associated with the rules get assigned but in the DB the field USR_POLICY_UPDATE remains null. If I update that field with a '1' and re-run "Evaluate User Policies," the resources are provisioned correctly.
I am wondering if anyone has seen this before or has a suggestion as to how to resolve this.
Thanks,
Stephen

Thanks for the suggestion. As it turned out, I did not have Retrofit checked but unfortunately that did not resolve the issue. The behavior remained the same after checking and re-running 'Evaluate User Policies'.
I may have a workaround for this issue that I am in the process of implementing. I'm creating a job that will run right before 'Enable User After Start Date' that will update the USR_POLICY_UPDATE field to'1' if the status of a user is 'Disabled Until Start Date.' Then the user will get enabled, assigned the appropriate roles via rules, and 'Evaluate User Policies' should run and now find this user and apply the access policies.
Anyway, seems like there should be a simpler answer so I'll keep checking here if anyone has one. I'll also update if the above workaround works.
Thanks,
Stephen

Anonymous user - Disabled

Hi,
I have recently disabled the anonymous user in my 12.1.3 environment as part of implementing the recommended best pratice security measures for E-business. Now when I run the failed login report I notice numerous failed logins for the anonymous user. Can somebody shed some light on why these login attempts are occurring and how I can stop them?
Thanks

868825 wrote:
Hi,
I have recently disabled the anonymous user in my 12.1.3 environment as part of implementing the recommended best pratice security measures for E-business. Now when I run the failed login report I notice numerous failed logins for the anonymous user. Can somebody shed some light on why these login attempts are occurring and how I can stop them?
ThanksAs you mentioned, Anonymous user can be disabled with no issues.
Can you post the contents of the concurrent request output file here?
Thanks,
Hussein

Cannot stop users disabling WiFi

Users who are not local administrators and via the control panel cannot do so can disable the WiFi via the sidebar BS in Windows 8.1. This is costing us large amounts of time supporting customers and talking through remotely re-enabling or leading to confusion
for us attempting to troubleshoot issues - There are now 3 places (control panel, sidebar, physical switch and/or keyboard shortcut) to go through.
Why is this possible to do when the users are no local administrators and should not have that access? They receive a UAC prompt when attempting to do the exact same thing in Control Panel.
How do we stop users exploiting yet another ignored bug from Microsoft?

Hi
Are they part of any administrator groups on the machine?
The other alternative is using a GPO to "remove" the feature from the computer but i guess they need to be on your network for that to work.
for ref: http://www.addictivetips.com/windows-tips/how-to-prevent-windows-7-local-account-users-from-changing-internet-settings/
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

User disabled in LDAP triggers disable identity in IDM?

IDM 7.0 on Sun JES Stack
Authoritative Source is LDAP, Sun Directory Server 5.2
This pertains to Termination e.g. Employee/Contractor gets terminated.
1) When an employee is terminated, her user LDAP record is deleted from LDAP (authoritative source)
2) When a contractor is terminated, her user obuseraccountcontrol = DISABLED in LDAP (authoritative source)
Based on the above two criteria, how do I trigger the Disable User workflow in IDM so that the user's IDM Identity gets disabled?
I've been exploring the LDAP Activation Method/Parameter?
com.waveset.adapter.util.ActivationByAttributePullDisablePushEnable
But am unsure on how to approach this. Has anyone successfully implemented this? Documentation is pretty unclear. Thanks in advance.

Given the below scenarios:
1) When an employee is terminated, her user LDAP record is deleted from LDAP (authoritative source)
2) When a contractor is terminated, her user obuseraccountcontrol = DISABLED in LDAP (authoritative source)
We've resolved #2 using MetaView and Rule. On the LDAP resource adapter itself, we used:
LDAP Activation Method: nsaccountlock
LDAP Activation Parameter: accountLockAttr
(where this is your IDM system attrib specified in resource schema)
In MetaView, for attrib "accountLockAttr", Source: Rule: Is obuseraccountcontrol disabled, Target: IDM, All Resources
In MetaView > Identity Events, we set the Disable event,
Based on that, we believe we can resolve #1 to trigger the Disable User Workflow. The problem is, how do you Re-Enable a user if the user's LDAP record is deleted from the authoritative source (LDAP)?

CWMS ldap users disabled

After the weekly ldap sync with Callmanager, all users have been set inactive with the "* User has been disabled on LDAP" message. The users are still active in LDAP and can authenticate to Callmanager. Tried re-sync and it shows 0 added and 0 set inactive. Any ideas?
CWMS version 2.0.1.407.B-AE

Hi,
You are hitting a known bug - CSCup62113. This is fixed in HF2 for 2.0 MR4. Please, open a ticket with Conferencing TAC to get the HF2 published for you.
-Dejan

How to check: password expired,password forced to change,user disable

I am writing application to detect the following. I just need to check whether the condition is true. What are the things that I need to check for:
- when a user password is going to expired in x days?
- when a user is forced to changed a his password?
- when a user is disabled? For this, do I check the attribute "nsaccountlock=true"?
Chooichin

I am writing application to detect the following. I
just need to check whether the condition is true.
What are the things that I need to check for:
- when a user password is going to expired in x
days?
you can use he passwordControls during a BIND operation and investigate if the password expired/expiring in so many secs
- when a user is forced to changed a his password?
- when a user is disabled? For this, do I check the
attribute "nsaccountlock=true"?Yes, if some interface is actually using this to disable the user in the first place.
>
Chooichin

Malware - Safari users - disable Open"safe" files after downloading

For those not aware there's some malware floating around which goes by the name of MacDefender and other variants.
It's a scam that may show a page suggesting 'virus' infection on the user's machine and/or download an installer file.
Visiting malicious sites or apparently just browsing some Google Images searches will automatically download a zipped file. If the Safari Preference to Open "safe" files after downloading is checked it will unzip and run the installer for the malware.
While installing requires user intervention to click through the installation, the most recent variant will apparently install for a user without needing an administrator password.
Once installed the malware apparently opens unsavoury websites randomly and prompts for credit card details to remove them.
This is unpleasant scareware to steal your credit card info.
Beware.
AC

just for information (in case you haven't seen these yet):
Mac OS X 10.6 Help: What is malware?
How to avoid or remove Mac Defender malware
Mac Virus/Malware Info
Identifying and removing MacDefender trojans

Can users disable autosave in Lion yet?

I work with very large documents (often >500 MB). If changes to image quality (say, auto levels) are made on a file of this size in Preview, does autosave make a copy of the entire file? This will eat up my hard drive in a matter of days. Worse yet, the autosaving makes Preview crash on large files. Guess what gets saved then? Why, a blank version, of course.
When Preview crashes, the next time I launch it tries to open the exact same file that crashed it. This annoys me to no end. I've lost an entire afternoon of productivity today. Do I need to downgrade back to Leopand? Is Apple software no longer useful for working on large files?

epocmit wrote:
Can users turn all this off? If not, are there any plans to allow us to do so in the future? I cannot believe that Apple would implement something like this without allowing some user control. Giving the user the ability to manage files on a computer is the most fundamental thing that an operating system does.
A lot of the big software developers are now following suite and implementing AutoSave/Versions into their software. To be honest, it took me under a week to get used to it and now I never give it a second thought. Not every feature can keep being implemented in updated software. The companies sometimes have to dump some dead wood for up to date features that even larger numbers are calling for, heading into the future of computing. That is why there is still the option to run older OSXs on older hardware, or use the current Mindows environment, which by all reports may be one it's way to changing drastically with the introduction of System 8. There are a lot of users finding it hard in learning to use new GUI features how does anybody know what was and what wasn't able to be written into the coding of Lion?
But looking at the upcoming Mountain Lion, AutoSave and Versions is something that you well may take some time to get used to if you wish to keep up with future OSXs
Good Luck
Pete

User Disable

Similar Messages

Maybe you are looking for