Table 29: Effective configuration parameters
TargetSystem | ADS | MemberShipRestriction | Container |
Number of Active Directory objects allowed per container before warning email is sent. |
TargetSystem | ADS | MemberShipRestriction | Group |
Number of Active Directory objects allowed per group before warning email is sent. |
TargetSystem | ADS | MemberShipRestriction | MailNotification |
Default mail address for sending warning emails. |
A mechanism to monitor user account memberships to limit the number of members in groups and containers,
-
The ADSAccountInADSGroup and ADSAccounttables are monitored with respect to the number of user account memberships in a group and the number of user accounts in a container.
-
The ADSContactInADSGroup and ADSContact tables are monitored with respect to the number of contact memberships in a group and the number of contacts in a container.
-
The ADSGrouInADSGroup and ADSGroup tables are monitored with respect to the number of contact memberships in a group and the number of groups in a container.
-
The ADSMachineInADSGroup and ADSMachine tables are monitored with respect to the number of computer memberships in a group and the number of computers in a container.
NOTE: The primary groups of Active Directory objects are not taken into account when membership per group is calculated.
Thresholds are set using configuration parameters. If the values in the parameters are exceeded, a warning message is sent to a defined mail address. The warning is only generated the first time the threshold is exceeded. This prevents warnings being send to the given address each time the threshold is exceeded, which could occur during synchronization for example.
Example: Monitoring group memberships
The threshold value for the number of objects in a Members group is limited to ten members (TargetSystem | ADS | MemberShipRestriction | Group=10). The Members group currently contains ten user accounts. When an 11th user account is added, a warning is generated and sent by email to the given address. When further user accounts are added, however, no more warning emails are sent.
Containers are represented by a hierarchical tree structure. The containers that already exist can be loaded from the Active Directory environment into the One Identity Manager database by synchronization. System containers, which are entered into the One Identity Manager database are labeled correspondingly.
Related topics
To edit or create a container
-
In the Manager, select the Active Directory > Container category.
-
Select the container in the result list and run the Change main data task.
- OR -
Click in the result list.
-
Edit the container's main data.
- Save the changes.
Detailed information about this topic
Enter the following data for a container.
Table 30: Main data for a container
Name |
Container name. |
Distinguished name |
Container's distinguished name. The distinguished name for the new container is made up of the container name, the object class, the parent container, and the domain, and it cannot be modified. |
Structural object class |
Structural object class representing the object type. |
Object class |
List of classes defining the attributes for this object. The object classes listed are read in from the database during synchronization with the Active Directory environment. You can also enter object classes in to the input field. Other properties can be edited depending on the object class.
NOTE: New containers should be set up as organizational units (ORGANIZATIONALUNIT object class). Organizational units (for example, branches, or departments) are used organize Active Directory objects, such as users, groups, and computers, in a logical way and therefore make administration of the objects easier. Organizational units can be managed in a hierarchical container structure. |
Domain |
Container domain |
Parent container |
Parent container for mapping a hierarchical container structure. The distinguished name is automatically updated using templates. |
Account manager |
Manager responsible for the container.
To specify an account manager
- Click next to the field.
- In the Table menu, select the table that maps the account manager.
- In the Account manager menu, select the manager.
- Click OK.
|
Target system manager |
Application role in which target system managers are specified for the container. Target system managers only edit container objects that are assigned to them. Each container can have a different target system manager assigned to it.
Select the One Identity Manager application role whose members are responsible for administration of this container. Use the button to add a new application role. |
Street |
Street or road. |
Zip code |
Zip code. |
Location |
Location. |
State |
State. |
Country ID |
The country ID. |
Description |
Text field for additional explanation. |
Extended Function |
Filter criteria for other representations of the container. Containers marked with this option are only shown in the Active Directory user account and computer manager when advanced mode console view is active. |
Protected from accidental deletion |
Specifies whether to protect the container against accidental deletion. If the option is set, the permissions for deleting the container are removed in Active Directory. The container cannot be deleted or moved. |
Related topics