Active Roles 7.2.1 - Administrator Guide

This policy generates a user logon name (pre-Windows 2000) for a user account being created. You can configure it to:

• Add a uniqueness number to the generated logon name
• Apply multiple rules to generate a logon name
• Allow a logon name to be specified manually during the user creation process

By combining these options, you can ensure uniqueness of the user logon name (pre-Windows 2000), which is a schema requirement in Active Directory.

This policy ensures that newly created user accounts have the appropriate e-mail aliases set up. You can configure it to generate aliases based on:

• Pre-selected user properties, such as the first and last names
• Custom selection of properties, not limited to user properties

The policy provides the ability to make each alias unique by adding a uniqueness number to the alias.

This policy ensures that user mailboxes are created in appropriate mailbox stores or databases. You can configure it to:

• Determine the mailbox stores or databases in which creation of mailboxes is allowed
• Apply a rule to distribute mailboxes among multiple stores or databases

The policy makes it possible to distribute mailboxes by using the round-robin method or by selecting a store or database with the least number of mailboxes.

This policy ensures that user accounts belong to appropriate groups. You can configure it to:

• Add user accounts to certain groups
• Remove user accounts from certain groups

You can select groups and set up criteria. The policy adds a user account to, or removes it from, the selected groups depending on whether the user account meets the specified criteria. The policy can also be applied to directory objects other than user accounts.

This policy performs provisioning actions needed to assign home folders and home shares to user accounts. You can configure it to:

• Create home folders for newly created user accounts
• Rename home folders upon renaming of user accounts

You can specify the server on which to create home folders and shares, determine naming conventions for home folders and shares, and configure access rights to the newly created home folders and shares.

This policy generates and validates directory data, such as user properties. You can configure it to:

• Populate directory with default data
• Perform data validity check upon directory updates

You can specify how you want the policy to generate directory data by default and what validation criteria must be applied to ensure compliance of directory data with your corporate standards.

When deprovisioning a user, this policy modifies the user account so that the user cannot log on. You can configure this policy to:

• Disable the user account
• Set the user’s password to a random value
• Set the user’s logon names to random values
• Rename the user account

You can also select account properties and configure this policy to update them when processing a deprovisioning request.

When deprovisioning a user, this policy removes the user account from groups. You can configure this policy to remove the account from security groups, mail-enabled groups, or both. In this policy, both distribution groups and mail-enabled security groups are collectively referred to as mail-enabled groups.

You can also select the groups from which you want this policy not to remove the user account, or configure the policy not to remove the user account from any security groups or mail-enabled groups.

When deprovisioning a user, this policy moves the user account to a different location. You can select the organizational unit to which you want the policy to move the account. You can also configure the policy not to move the user accounts upon user deprovisioning.

When deprovisioning a user, this policy makes changes needed to deprovision Microsoft Exchange resources for that user. You can configure this policy to:

• Hide the mailbox from the global address list (GAL)
• Prevent non-delivery reports (NDR) from being sent
• Grant the user’s manager full access to the user’s mailbox
• Grant selected users or groups full access to the user’s mailbox
• Disallow forwarding messages to alternate recipients
• Forward all incoming messages to the user’s manager

When deprovisioning a user, this policy makes changes needed to prevent the user from accessing his or her home folder. You can configure this policy to:

• Remove the user’s permissions on the home folder
• Grant the user’s manager read-only access to the user’s home folder
• Grant selected users or groups read-only access to the user’s home folder
• Make a selected user or group the owner of the user’s home folder
• Delete the home folder when the user account is deleted

When deprovisioning a user, this policy schedules the user account for deletion. You can specify the number of days (retention period) before the account is deleted. Another option is to delete the deprovisioned user accounts immediately to Active Directory Recycle Bin. It is also possible to configure this policy so that the deprovisioned user accounts are not deleted automatically.

When deprovisioning a group, this policy makes changes to the group object in Active Directory in order to prevent the use of the group. You can configure this policy to:

• Hide the group from the Global Address List (GAL)
• Change the group type from Security to Distribution
• Rename the group
• Remove members from the group
• Change or clear any other properties of the group object

When deprovisioning a group, this policy moves the group object to a different container in Active Directory. You can select the organizational unit to which you want the policy to move the group object.

When deprovisioning a group, this policy schedules the group object for deletion in Active Directory. You can specify the number of days (retention period) before the group is deleted. Another option is to delete the deprovisioned groups immediately to Active Directory Recycle Bin. It is also possible to configure this policy so that the deprovisioned groups are not deleted automatically.

In the course of a deprovisioning operation, this policy sends a notification message to the e-mail recipients you specify. You can customize both the message subject and message body.

Upon completion of a deprovisioning operation, this policy sends a report to the e-mail recipients you specify. The report includes a list of actions taken during the deprovisioning operation and the details of the deprovisioning activity. You can customize the subject of the e-mail message containing the report.

You can also configure this policy to send the report only if any errors occurred in the course of a deprovisioning operation.