-
Title
Modifying the deprovisioning process to remove user deprovisioning deletion dates and retention periods -
Description
When a configuration contains deprovisioning policies that define a retention period after which to delete a deprovisioned user, care must be taken when removing these settings to ensure no further deprovisioned objects are deleted unintentionally. -
Resolution
The initial step that must be taken to remove the deprovisioned object deletion settings is to modify the deprovisioning Policy, and configure the option: Do not automatically delete the object
- Navigate to the desired deprovisioning Policy
- Select the Policy: Deletes deprovisioned user after % day retention period
- Click View/Edit...
- Select the option: Do not automatically delete the object
IMPORTANT: Modifying the deprovisioning Policy will prevent all future deprovisioned objects from attaining a deprovisioning deletion date, however it will not prevent any objects currently pending deletion from being deleted once the previously configured retention period has been met.
To prevent objects currently pending deletion from being deleted after meeting their retention period, the edsvaDeprovisionDeletionDate attribute must be cleared on the object. This can be cleared manually via querying the object's Advanced Properties and clearing the attribute value. Clearing this attribute value can also be automated via the Active Roles Management Shell.
As an extra precaution, the Builtin scheduled task Deletion of Deprovision Objects can also be disabled if desired. This scheduled task runs nightly by default, and deletes all objects with an edsvaDeprovisionDeletionDate timestamp value of the current day or earlier.
- Navigate to Configuration | Server Configuration | Scheduled Tasks | Builtin
- Right click on the Deletion of Deprovisioned Objects scheduled task and select Properties
- Uncheck the Enabled checkbox
