Identity Manager 9.0 LTS - Administration Guide for Active Roles Integration

Preprocessor relevant configuration parameter for automatically adding Active Directory groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

The configuration parameter specifies whether the template should be applied to the ADSGroup.DisplayName column.

List of all Active Directory groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

Preprocessor relevant configuration parameter for controlling database model components for Active Directory target system administration. If the parameter is set, the target system components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

Allows configuration of user account data.

Specifies whether a random password is generated when a new user account is added. The password must contain at least those character sets that are defined in the password policy.

Employee to receive an email with the random generated password (manager cost center/department/location/business role, employee’s manager or XUserInserted). If no recipient can be found, the password is sent to the address stored in the configuration parameter TargetSystem | ADS | DefaultAddress.

Mail template name that is sent to supply users with the login credentials for the user account. The Employee - new user account created mail template is used.

Mail template name that is sent to supply users with the initial password. The Employee - initial password for new user account mail template is used.

Mail template used to send notifications about whether default IT operating data mapping values are used for automatically creating a user account. The Employee - new user account with default properties created mail template is used.

Specifies whether a password is required when creating new Active Directory user accounts in One Identity Manager. If the configuration parameter is not set, entry of a password that meets the defined password guidelines is requested when a new Active Directory user account is created. If the configuration parameter is set, it is not necessary to specify a password when creating new Active Directory user accounts.

Allows configuration of privileged Active Directory user account settings.

Postfix for formatting the login name of privileged user accounts.

Prefix for formatting a login name of privileged user accounts.

Fixed string appended to the default profile path of a user profile.

Specifies whether changes to the employee's picture are published in existing user accounts. The picture is not part of default synchronization. It is only published when employee data is changed.

Specifies whether the SID history is loaded from the target system.

Fixed string appended to the default profile path of a user profile on a terminal server.

Specifies whether the employee's Active Directory user account is unlocked when the central password is synchronized.

Specifies whether the Change password at next login option is enabled when a new user account is created.

Preprocessor relevant configuration parameter to control the database model components for supporting Active Roles. If the parameter is set, Self-Service Management components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

Preprocessor relevant configuration parameter for controlling the database model components for One Identity Active Roles Self-Service Manager in the One Identity Manager IT Shop. If the parameter is set, Self-Service Management components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

Pipe (|) delimited list of domains to be used by the manual Active Directory authentication module to authenticate users. The list is processed in the given order. This list should only contain domains to be synchronized.

Example:

MyDomain|MyOtherDomain

For more information about One Identity Manager authentication modules, see the One Identity Manager Authorization and Authentication Guide.

Specifies whether departments are automatically created when user accounts are modified or synchronized.

Specifies whether locations are automatically created when user accounts are modified or synchronized.

Specifies whether corresponding device types are created automatically in the database for imported printer objects.

Specifies whether entries for missing home servers and profile servers are created automatically when user accounts are synchronized.

Language of automatically created servers.

Default email address of the recipient for notifications about actions in the target system.

Specifies whether computers are added to groups based on group assignment to roles.

Maximum runtime of a synchronization in minutes. No recalculation of group memberships by the DBQueue Processor can take place during this time. If the maximum runtime is exceeded, group membership are recalculated.

Specifies whether membership validity is verified on saving when group memberships are assigned in the One Identity Manager database.

Disable this configuration parameter if several trusted domains with access across memberships are managed in the database.

General configuration parameter for restricting membership in Active Directory.

Number of Active Directory objects allowed per container before warning email is sent.

Number of Active Directory objects allowed per group before warning email is sent.

Default mail address for sending warning emails.

Mode for automatic employee assignment for user accounts added to the database outside synchronization.

Specifies whether employees are automatically assigned to disabled user accounts. User accounts are not given an account definition.

Mode for automatic employee assignment for user accounts that are added to or updated in the database by synchronization.

Listing of all user account without automatic employee assignment. Names are listed in a pipe (|) delimited list that is handled as a regular search pattern.

Example:

ADMINISTRATOR|GUEST|KRBTGT|TSINTERNETUSER|IUSR_.*|IWAM_.*|SUPPORT_.*|.* | $

Specifies whether employees are updated if their user accounts are changed. This configuration parameter is set to allow ongoing update of employee objects from associated user accounts.

Speeds up synchronization of modifications between two domain controllers When set, the accumulated modifications in Active Directory are immediately replicated between domain controllers.