Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Active Roles 7.2 - Administration Guide

Table of Contents

Introduction About Active Roles

Technical overview

Presentation components

Active Roles console (MMC Interface) Web Interface Custom Interfaces Active Roles ADSI Provider Reporting

Service components

Data processing component Configuration database Audit trail

Network data sources Security and administration elements

Access Templates for role-based administration Policy Objects to enforce corporate rules Managed Units to provide administrative views

Active Directory security management

Management of native security

Customization using ADSI Provider and script policies

Custom applications and user interfaces Custom script policies

Dynamic groups Workflows Operation in multi-forest environments

Getting Started

Starting the Active Roles console

Getting and using help

User Interface overview

Console tree Details pane Advanced pane

Active Roles Security, Links Active Roles Policy Native Security Member Of, Members

Controlled objects

Using Managed Units Setting up filter

Steps for sorting and filtering lists in the details pane

Finding objects

Steps for searching for a user, contact, or group Steps for searching for a computer Steps for searching for an Organizational Unit Steps for using advanced search options Steps for building a custom search LDAP syntax

Search filter format Operators Wildcards Special characters

Getting policy-related information

Rule-based Administrative Views

About Managed Units

How Managed Units work

Administering Managed Units

Creating a Managed Unit

Steps for creating a Managed Unit Steps for modifying Managed Unit properties Steps for modifying permission settings on a Managed Unit Steps for modifying policy settings on a Managed Unit

Displaying members of a Managed Unit

Steps for displaying members of a Managed Unit

Adding or removing members from a Managed Unit

Steps for adding membership rules to a Managed Unit Steps for removing membership rules from a Managed Unit Steps for including a member to a Managed Unit Steps for excluding a member from a Managed Unit Steps for adding group members to a Managed Unit Steps for removing group members from a Managed Unit

Copying a Managed Unit

Steps for copying a Managed Unit

Exporting and importing a Managed Unit Renaming a Managed Unit

Steps for renaming a managed Unit

Deleting a Managed Unit

Steps for deleting a Managed Unit

Scenario: Implementing role-based administration across multiple OUs

Step 1: Creating the Managed Unit Step 2: Adding users to the Managed Unit Step 3: Preparing the Access Template Step 4: Applying the Access Template

Deployment considerations

Managed Unit membership rules Delegation of Managed Units

Role-based Administration

Access Templates as administrative roles

How Access Templates work Security synchronization

Access Template management tasks

Using predefined Access Templates

Active Directory Azure AD LDS (ADAM) Computer Resources Configuration Exchange User Self-management

Creating an Access Template

Add Permission Entries wizard Full Control access Object access Object property access Creation/Deletion of child objects permission Steps for creating an Access Template

Applying Access Templates

Steps for applying an Access Template

Managing Access Template links

Steps for managing Access Template links

Synchronizing permissions to Active Directory

Steps for synchronizing permissions to Active Directory Managing Active Directory permission entries

Adding, modifying, or removing permissions

Steps for adding permissions to an Access Template Steps for modifying permissions in an Access Template Steps for removing permissions from an Access Template

Nesting Access Templates

Steps for managing nested Access Templates

Copying an Access Template

Steps for copying an Access Template

Exporting and importing Access Templates Renaming an Access Template

Steps for renaming an Access Template

Deleting an Access Template

Steps for deleting an Access Template

Examples of use

Scenario 1: Implementing a Help Desk

Step 1: Preparing a Help Desk Access Template Step 2: Creating a Help Desk group Step 3: Applying the Help Desk Access Template

Scenario 2: Implementing Self-administration

Step 1: Preparing a self-administration Access Template Step 2: Applying the self-administration Access Template

Deployment considerations

Delegation of Organizational Unit administration Delegation of group administration Delegation in a functional vs. hosted environment

Delegation in a functional environment Delegation in a hosted environment

Windows claims-based Access Rules

Understanding Access Rules

Conditional Access Template links Prerequisites for using Access Rules

Configuring the Administration Service to support Kerberos authentication

Managing Windows claims

Enabling claim support

Domain controller Client computer

Claim Type management overview

Source attribute setting Claim type identifier setting Display name setting Description setting User or computer claim issuance setting Protection from accidental deletion Suggested values setting

Steps for managing Claim Types

Enabling and disabling claim types

Populating claim source attributes

Managing and applying Access Rules

Conditional expression editor Applying an Access Rule Steps for managing and applying Access Rules

Create or modify an Access Rule Configure a conditional expression for an Access Rule Apply an Access Rule to Access Template links

Deploying an Access Rule (demonstration steps)

Step 1. Prerequisites Step 2. Enable claim support Step 3. Create Claim Type Step 4. Create Access Rule Step 5. Apply Access Rule

Rule-based AutoProvisioning and Deprovisioning

About Policy Objects

Provisioning Policy Objects Deprovisioning Policy Objects How Policy Objects work

Policy Object management tasks

Creating a Policy Object

Steps for creating a Policy Object

Adding, modifying, or removing policies

Steps for adding policies to a Policy Object Steps for modifying policies in a Policy Object Steps for removing policies from a Policy Object

Applying Policy Objects

Adding Managed Units or containers to policy scope Adding Policy Objects to policy list for directory object Steps for applying a Policy Object

Managing policy scope

Steps for managing Policy Object links Steps for excluding an object from policy scope

Copying a Policy Object

Steps for copying a Policy Object

Renaming a Policy Object

Steps for renaming a Policy Object

Exporting and importing Policy Objects Deleting a Policy Object

Steps for deleting a Policy Object

Policy configuration tasks

Property Generation and Validation

How this policy works How to configure a Property Generation and Validation policy

Entry type: Text Entry type: <Object> Property Entry type: Parent OU Property Entry type: Parent Domain Property Entry type: Mask Steps for configuring a Property Generation and Validation policy Steps for configuring entries Scenario 1: Using mask to control phone number format

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Scenario 2: Using regular expressions to control phone number format

Step 1: Configuring the Policy Object Step 2: Applying the Policy Object

User Logon Name Generation

How this policy works How to configure a User Logon Name Generation policy

Configuring a logon name generation rule Entry type: Uniqueness Number

Steps for configuring a User Logon Name Generation policy Scenario 1: Using uniqueness number

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Scenario 2: Using multiple rules

Step 1: Configuring the Policy Object Step 2: Applying the Policy Object

Group Membership AutoProvisioning

How this policy works How to configure a Group Membership AutoProvisioning policy Steps for configuring a Group Membership AutoProvisioning policy Scenario: Adding users to a specified group

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

E-mail Alias Generation

How this policy works How to configure an E-mail Alias Generation policy

Configuring a custom generation rule

Steps for configuring an E-mail Alias Generation policy Scenario: Generating e-mail alias based on user names

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Exchange Mailbox AutoProvisioning

How this policy works How to configure an Exchange Mailbox AutoProvisioning policy Steps for configuring an Exchange Mailbox AutoProvisioning policy Scenario: Mailbox store load balancing

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Default creation options for Exchange mailbox

Home Folder AutoProvisioning

How this policy works

Creating home folders and shares when creating user accounts Renaming home folders when renaming user accounts Option to prevent operation on file server

How to configure a Home Folder AutoProvisioning policy

Connect <Drive Letter> To <Network Path> Enforce this home folder setting in Active Directory Apply this home folder setting when user account is created Apply this home folder setting when user account is renamed Create or rename home folder on file server as needed Copy user permissions on home folder from parent folder Set user as home folder owner Set user permissions on home folder

Steps for configuring a Home Folder AutoProvisioning policy Using the built-in policy for home folder provisioning Configuring the Home Folder Location Restriction policy Scenario: Creating and assigning home folders

Step 1: Verifying the Home Folder Location Restriction policy Step 2: Creating and Configuring the Policy Object Step 3: Applying the Policy Object

Script Execution

How this policy works How to configure Script Execution policy

Importing a script Creating a script Editing a script Configuring a policy to execute a script

Steps for configuring a Script Execution policy Scenario: Restricting group scope

Step 1: Preparing the script module Step 2: Creating and configuring the Policy Object Step 3: Applying the Policy Object

User Account Deprovisioning

How this policy works How to configure a User Account Deprovisioning policy

Configuring a property update rule Entry type: Date and Time Entry type: Initiator ID Configuring a custom rule to build the Initiator ID

Steps for configuring a User Account Deprovisioning policy Scenario 1: Disabling and renaming the user account upon deprovisioning

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Scenario 2: Managed Unit for deprovisioned user accounts

Step 1: Creating and configuring the Managed Unit Step 2: Configuring the Policy Object Step 3: Applying the Policy Object

Group Membership Removal

How this policy works How to configure a Group Membership Removal policy Steps for configuring a Group Membership Removal policy Scenario: Removing deprovisioned users from all groups

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Exchange Mailbox Deprovisioning

How this policy works How to configure an Exchange Mailbox Deprovisioning policy Steps for configuring an Exchange Mailbox Deprovisioning policy Scenario: Hide mailbox and forward e-mail to manager

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Home Folder Deprovisioning

How this policy works How to configure a Home Folder Deprovisioning policy Steps for configuring a Home Folder Deprovisioning policy Scenario: Removing access to home folder

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

User Account Relocation

How this policy works How to configure a User Account Relocation policy Steps for configuring a User Account Relocation policy Scenario: Organizational Unit for deprovisioned user accounts

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

User Account Permanent Deletion

How this policy works How to configure a User Account Permanent Deletion policy Steps for configuring a User Account Permanent Deletion policy Scenario: Deleting deprovisioned user accounts

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Group Object Deprovisioning

How this policy works How to configure a Group Object Deprovisioning policy Steps for configuring a Group Object Deprovisioning policy Scenario 1: Disabling and renaming the group upon deprovisioning

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Scenario 2: Managed Unit for deprovisioned groups

Step 1: Creating and configuring the Managed Unit Step 2: Configuring the Policy Object Step 3: Applying the Policy Object

Group Object Relocation

How this policy works How to configure a Group Object Relocation policy Steps for configuring a Group Object Relocation policy Scenario: Organizational Unit for deprovisioned groups

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Group Object Permanent Deletion

How this policy works How to configure a Group Object Permanent Deletion policy Steps for configuring a Group Object Permanent Deletion policy Scenario: Deleting deprovisioned groups

Step 1: Creating and configuring the Policy Object Step 2: Applying the Policy Object

Notification Distribution

How this policy works How to configure a Notification Distribution policy Configuring e-mail settings Steps for configuring a Notification Distribution policy Scenario: Sending deprovisioning notification

Step 1: Creating the e-mail configuration Step 2: Creating, configuring, and applying the Policy Object

Report Distribution

How this policy works How to configure a Report Distribution policy Steps for configuring a Report Distribution policy Scenario: Sending deprovisioning report

Step 1: Creating the e-mail configuration Step 2: Creating, configuring, and applying the Policy Object

Deployment considerations Checking for policy compliance

Steps to check for policy compliance

Deprovisioning users or groups

Default deprovisioning options Delegating the Deprovision task Using the Deprovision command Report on deprovisioning results

Report contents

Report section: User Account Deprovisioning Report section: Group Membership Removal Report section: Exchange Mailbox Deprovisioning Report section: Home Folder Deprovisioning Report section: User Account Relocation Report section: User Account Permanent Deletion Report section: Group Object Deprovisioning Report section: Group Object Relocation Report section: Group Object Permanent Deletion Report section: Notification Distribution Report section: Report Distribution

Restoring deprovisioned users or groups

Policy options to undo user deprovisioning Delegating the task to undo deprovisioning Using the Undo Deprovisioning command Report on results of undo deprovisioning

Report contents

Report section: Undo User Account Deprovisioning Report section: Undo Group Membership Removal Report section: Undo Exchange Mailbox Deprovisioning Report section: Undo Home Folder Deprovisioning Report section: Undo User Account Relocation Report section: Undo User Account Permanent Deletion Report section: Undo Group Object Deprovisioning Report section: Undo Group Object Relocation Report section: Undo Group Object Permanent Deletion

Container Deletion Prevention policy

Protecting objects from accidental deletion

Picture management rules Policy extensions

Design elements

Policy type deployment Policy type usage Policy Type objects

Creating and managing custom policy types

Creating a Policy Type object Changing an existing Policy Type object Using Policy Type containers Exporting policy types Importing policy types Configuring a policy of a custom type Deleting a Policy Type object

Understanding workflow

Key features and definitions

Workflow Workflow definition Workflow start conditions Workflow instance Workflow activity Workflow Designer Workflow engine E-mail Notifications

About workflow processes Workflow processing overview

About start conditions

Workflow activities overview

Approval activity

Approvers and escalation Request for information Customization Notification

Notification recipients Notification delivery Notification message Web Interface address E-mail server

Notification activity

Notification recipients Notification message Web Interface address E-mail server

Script activity

Notification Error handling

If-Else activity

If-Else branch conditions Error handling

Stop/Break activity Add Report Section activity Search activity

Search scenario Object type Search scope Search options Search for inactive accounts Search filter Notification Error handling “Run as” options Additional settings Stop Search activity

CRUD activities

“Create” activity “Update” activity “Add to group” activity “Remove from group” activity “Move” activity “Deprovision” activity “Undo deprovision” activity “Delete” activity Activity target Notification Error handling “Run as” options Additional settings

Save Object Properties activity

Retrieving saved properties

Modify Requested Changes activity

Configuring a workflow

Creating a workflow definition Configuring workflow start conditions

Operation conditions Initiator conditions Filtering conditions

Steps to configure filtering conditions Configuring script-based conditions “Run as” options Enforce approval

Configuring workflow parameters Adding activities to a workflow Configuring an Approval activity

Configure approvers Configure escalation Configure request for additional information Configure request for review Customize the header of the approval task page Customize approval action buttons

Configuring a Notification activity

Events, recipients and messages Active Roles Web Interface E-mail server settings

Configuring a Script activity Configuring an If-Else activity

Steps to configure error handling Configuring conditions for an If-Else branch

Configuring a script-based condition

Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity

Configure scope and filter

Configuring a search filter

Configure notification Configure error handling Configure “run as” options Configure additional settings

Configuring CRUD activities

“Create” activity “Update” activity “Add to group” activity “Remove from group” activity “Move” activity “Deprovision” activity “Undo deprovision” activity “Delete” activity Configuring notification Configuring error handling Configuring “run-as” options Configuring additional settings

Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script

Example: Approval workflow

Definition of terms

Approval Approval rule (Approval activity) Approval task Approver Initiator (requestor) Notification Operation Operation target object

Action: Approve Action: Reject Multiple approvers Multiple tasks

Creating and configuring an approval workflow

Creating a workflow definition Specifying workflow start conditions Specifying approvers Configuring notification

Notification recipients Notification delivery Notification message template

E-mail based approval

Integration with Microsoft Outlook

Software and configuration requirements

Integration with non-Outlook e-mail clients

Software and configuration requirements

E-mail transport via Exchange Web Services

Configuration settings

Exchange Web Services address Active Roles mailbox credentials Options for the Approve and Reject links

Steps to configure the use of Exchange Web Services

Automation workflow

Automation workflow options and start conditions

Run the workflow on a schedule

Server to run the workflow

Allow the workflow to be run on demand “Run as” options

Enforce approval

Additional settings Parameters Initialization script

Using automation workflow

Creating an automation workflow definition Configuring start conditions for an automation workflow Adding activities to an automation workflow Running an automation workflow on demand Viewing run history of an automation workflow Terminating a running automation workflow Disabling an automation workflow from running Re-enabling an automation workflow to run Delegating automation workflow tasks

Allowing access to workflow containers Delegating full control of automation workflows Delegating the task of running automation workflow Delegating the task of viewing run history of automation workflow

Activity extensions

Design elements

Activity type deployment Activity type usage Policy Type objects

Creating and managing custom activity types

Creating a Policy Type object Changing an existing Policy Type object Using Policy Type containers Exporting activity types Importing activity types Configuring an activity of a custom type Deleting a Policy Type object

Temporal Group Memberships

Understanding temporal group memberships Using temporal group memberships

Adding temporal members Viewing temporal members Rescheduling temporal group memberships Removing temporal members

Understanding Group Family

Design overview How it works

Cross-domain Group Family

Group Family policy options

Creating a Group Family

Start the New Group Family wizard Name the Group Family Grouping Options Location of managed objects Selection of managed objects Group-by properties

About multi-valued group-by properties

Capture existing groups manually Group naming rule

Entry type: Group-by Property Separate rule for each naming property

Group type and scope Location of groups Exchange-related settings Group Family scheduling Steps for creating a Group Family

Administering Group Family

Controlled groups General tab Controlled Groups tab

Group creation-related rules

Groupings tab Schedule tab Action Summary tab

Action summary log

Steps for administering a Group Family

Scenario: Departmental Group Family

Understanding dynamic groups

Cross-domain membership

Dynamic groups policy options Managing dynamic groups

Converting a basic group to a dynamic group Displaying the members of a dynamic group Adding a membership rule to a dynamic group Removing a membership rule from a dynamic group Converting a dynamic group to a basic group Modifying, renaming, or deleting a dynamic group

Scenario: Automatically moving users between groups

Step 1: Creating the groups Step 2: Configuring the membership rules

Active Roles Reporting

Introduction Collector to prepare data for reports

Starting the Active Roles Collector wizard Collecting data from the network

Steps for collecting data from the network

Processing gathered events

Steps for processing gathered events

Importing events from an earlier database version Deploying reports to the Report Server

Working with reports

Configuring the data source Generating and viewing a report Contents of the Active Roles Report Pack

Active Directory Assessment/Domains Active Directory Assessment/Users/Account Information Active Directory Assessment/Users/Exchange Active Directory Assessment/Users/Obsolete Accounts Active Directory Assessment/Users/Miscellaneous Information Active Directory Assessment/Groups Active Directory Assessment/Group Membership Active Directory Assessment/Organizational Units Active Directory Assessment/Other Directory Objects Active Directory Assessment/Potential Issues Active Roles Tracking Log/Active Directory Management Active Roles Tracking Log/Dashboard Active Roles Events Active Roles Configuration Changes Active Roles Workflow Administrative Roles Managed Units Policy Objects Policy Compliance

Management History

Understanding Management History

Considerations and best practices

Management History configuration

Change-tracking policy Change Tracking log configuration Replication of Management History data

Replication is not yet configured Replication is already configured Re-configuring replication of Management History data

Centralized Management History storage

Option 1: Dedicated Configuration database to store the Management History data Option 2: Separate database to store the Management History data Importing data to the new Management History database

Viewing change history

Workflow activity report sections

“Approval” activity “Script” activity “Stop/Break” activity “Add Report Section” activity “Create” activity “Update” activity “Add to group” activity “Remove from group” activity “Move” activity “Deprovision” activity “Undo deprovision” activity “Delete” activity

Policy report items

Report section: Executing the 'User Logon Name Generation' policy Report section: Executing the 'E-mail Alias Generation' policy Report section: Executing the 'Exchange Mailbox AutoProvisioning' policy Report section: Executing the 'Group Membership AutoProvisioning' policy Report section: Executing the 'Home Folder AutoProvisioning' policy Report section: Executing the 'Property Generation and Validation' policy Report section: Executing policy script 'name'

Active Roles internal policy report items

Report section: Creating user mailbox Report section: Creating linked mailbox Report section: Creating equipment mailbox Report section: Creating room mailbox Report section: Creating shared mailbox Report section: Moving mailbox Report section: Deleting mailbox Report section: Removing Exchange attributes Report section: Enabling mailbox for Unified Messaging Report section: Disabling Unified Messaging for mailbox Report section: Resetting Unified Messaging PIN Report section: Establishing e-mail address for group Report section: Creating query-based distribution group Report section: Establishing e-mail address for user Report section: Establishing e-mail address for contact Report section: Deleting e-mail address for group Report section: Deleting e-mail address for user Report section: Deleting e-mail address for contact Report section: Converting user mailbox to linked mailbox Report section: Converting linked mailbox to user mailbox

Examining user activity

Entitlement Profile

Understanding entitlement profile

About entitlement profile specifiers

Entitlement type Entitlement rules Resource display About entitlement profile build process

Entitlement profile configuration

Creating entitlement profile specifiers Changing entitlement profile specifiers Pre-defined specifiers

Viewing entitlement profile

Authorizing access to entitlement profile

Understanding Recycle Bin Finding and listing deleted objects

Searching the Deleted Objects container Searching for objects deleted from a certain OU or MU

Restoring a deleted object Delegating operations on deleted objects Applying policy or workflow rules

AD LDS Data Management

Registering an AD LDS instance Managing AD LDS objects

Adding an AD LDS user to the directory Adding an AD LDS group to the directory Adding or removing members from an AD LDS group Disabling or enabling an AD LDS user account Setting or modifying the password of an AD LDS user Adding an organizational unit to the directory Adding an AD LDS proxy object (user proxy)

Configuring Active Roles for AD LDS

Configuring Managed Units to include AD LDS objects Viewing or setting permissions on AD LDS objects Viewing or setting policies on AD LDS objects

Managing Configuration of Active Roles

Connecting to the Administration Service

Steps for connecting to the Administration Service

Adding and removing managed domains

Steps for adding or removing a managed domain

Using unmanaged domains

Configuring an unmanaged domain

Evaluating product usage

Viewing product usage statistics

Delegating access to the managed object statistics

Scheduled task to count managed objects Managed scope to control product usage Voluntary thresholds for the managed object count Installation label

Configuring replication

Understanding the replication model

The replication group

Configuring SQL Server Creating a replication group Adding members to a replication group

Steps for adding members to a replication group

Removing members from a replication group

Steps for removing members from a replication group

Monitoring replication

Using AlwaysOn Availability Groups

Availability Group setup in Active Roles

Configuring the database connection to use the listener

Case 1: Management History data stored in the Configuration database Case 2: Management History data stored in a separate database

Using database mirroring

Role switching Database Mirroring setup in Active Roles

Creating and using virtual attributes

Scenario: Implementing a Birthday attribute

Examining client sessions Monitoring performance Customizing the console

“Other Properties” page in object creation wizard “Other Properties” tab in the Properties dialog box Customizing object display names

Using Configuration Center

Configuration Center design elements Configuring a local or remote Active Roles instance Running Configuration Center

Pre-requisites to run the Configuration Center

Tasks you can perform in Configuration Center

Initial configuration tasks

Configure the Administration Service Configure the Web Interface

Administration Service management tasks

View the core Administration Service settings Change the core Administration Service settings Import configuration data Import management history data View the state of the Administration Service Start, stop or restart the Administration Service

Web Interface management tasks

Identify Web Interface sites Create a Web Interface site Modify a Web Interface site Delete a Web Interface site Export a Web Interface site’s configuration object to a file

Logging management tasks

Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer

Using Log Viewer

Using regular expressions

Examples of regular expressions Order of precedence

Administrative Template

Active Roles snap-in settings Administration Service auto-connect settings

'Allowed Servers for Auto-connect' setting 'Disallowed Servers for Auto-connect' setting 'Additional Servers for Auto-connect' setting

Loading the Administrative Template

Communication ports

Access to the managed environment

Access to DNS servers Access to domain controllers Access to Exchange servers Computer resource management Computer restart Home folder provisioning and deprovisioning Access to SMTP server for e-mail integration Access to AD LDS instances

Access to SMTP server for e-mail integration Access to Active Roles Administration Service Access to Web Interface

Report section: User Account Deprovisioning

Rule-based AutoProvisioning and Deprovisioning > Deprovisioning users or groups > Report on deprovisioning results > Report section: User Account Deprovisioning

Report section: User Account Deprovisioning

Table 29: User Account Deprovisioning
Report Item (Success)	Report Item (Failure)
The user account is disabled.	Failed to disable the user account.
The user password is reset to a random value.	Failed to reset the user password.
The user logon name is changed to a random value.	Failed to change the user logon name.
The user logon name (pre-Windows 2000) is changed to a random value.	Failed to change the user logon name (pre-Windows 2000).
The user name is changed. Original name: name New name: name	Failed to change the user name. Current name: name Failed to set this name: name
User properties are changed. List: User properties, old and new property values	Failed to change user properties. List: User properties, error description

Report section: Group Membership Removal

Rule-based AutoProvisioning and Deprovisioning > Deprovisioning users or groups > Report on deprovisioning results > Report section: Group Membership Removal

Report section: Group Membership Removal

Table 30: Group Membership Removal
Report Item (Success)	Report Item (Failure)
In accord with policy, the user is not removed from security groups, except for Dynamic Groups and groups controlled by Group Family. Details: Security groups to which the user belongs	Not applicable
The user is removed from all security groups. Details: Security groups from which the user is removed	Failed to remove the user from some security groups. Details: Security groups from which the user is removed Security groups from which the user is not removed due to an error
In accord with policy, the user is retained in some security groups. Details: Security groups from which the user is removed Security groups from which the user is not removed in accord with policy	Failed to remove the user from some security groups. Details: Security groups from which the user is removed Security groups from which the user is not removed in accord with policy Security groups from which the user is not removed due to an error
In accord with policy, the user is not removed from distribution groups or mail-enabled security groups, except for Dynamic Groups and groups controlled by Group Family. Details: Distribution groups and mail-enabled security groups to which the user belongs	Not applicable
The user is removed from all distribution groups and mail-enabled security groups. Details: Distribution groups and mail-enabled security groups from which the user is removed	Failed to remove the user from some distribution groups or mail-enabled security groups. Details: Distribution groups and mail-enabled security groups from which the user is removed Distribution groups or mail-enabled security groups from which the user is not removed due to an error
In accord with policy, the user is retained in some distribution groups or mail-enabled security groups. Details: Distribution groups and mail-enabled security groups from which the user is removed Distribution groups or mail-enabled security groups from which the user is not removed in accord with policy	Failed to remove the user from some distribution groups or mail-enabled security groups. Details: Distribution groups and mail-enabled security groups from which the user is removed Distribution groups or mail-enabled security groups from which the user is not removed in accord with policy Distribution groups or mail-enabled security groups from which the user is not removed due to an error

Report section: Exchange Mailbox Deprovisioning

Rule-based AutoProvisioning and Deprovisioning > Deprovisioning users or groups > Report on deprovisioning results > Report section: Exchange Mailbox Deprovisioning

Report section: Exchange Mailbox Deprovisioning

Table 31: Exchange Mailbox Deprovisioning
Report Item (Success)	Report Item (Failure)
Mailbox deprovisioning is skipped because the user does not have an Exchange mailbox.	Not applicable
The user mailbox is removed (hidden) from the Global Address List (GAL).	Failed to remove (hide) the user mailbox from the Global Address List (GAL).
The user mailbox is configured to suppress non-delivery reports (NDR).	Failed to configure the user mailbox to suppress non-delivery reports (NDR).
The user’s manager is provided with full access to the user mailbox. Manager name: name	Failed to provide the user’s manager with access to the user mailbox. Manager name: name
Not applicable	Failed to provide the user’s manager with access to the user mailbox. Reason: The user’s manager is not specified in the directory.
The required users and groups are provided with full access to the user mailbox. List: Users and groups	Failed to provide the required users or groups with access to the user mailbox. List: Users and groups
Forwarding messages to alternate recipients is disallowed on the user mailbox.	Failed to disallow forwarding messages to alternate recipients on the user mailbox.
The user mailbox is configured to forward incoming messages to the user’s manager.	Failed to configure the user mailbox to forward incoming messages to the user’s manager.
The user mailbox is configured to forward incoming messages to the user’s manager, with the option to leave message copies in the mailbox.	Failed to configure the user mailbox to forward incoming messages to the user’s manager.
Failed to configure the user mailbox to forward incoming messages to the user’s manager. Reason: the user’s manager is not specified in the directory.	Not applicable
Automatic replies turned on.	Failed to turn on automatic replies.

Report section: Home Folder Deprovisioning

Rule-based AutoProvisioning and Deprovisioning > Deprovisioning users or groups > Report on deprovisioning results > Report section: Home Folder Deprovisioning

Report section: Home Folder Deprovisioning

Table 32: Home Folder Deprovisioning
Report Item (Success)	Report Item (Failure)
Home folder deprovisioning is skipped because the user does not have a home folder.	Not applicable
The user’s rights on the home folder are removed.	Failed to remove the user’s rights on the home folder.
The user’s manager is provided with read-only access to the user home folder. Manager name: name	Failed to provide the user’s manager with read-only access to the user home folder. Manager name: name
Not applicable	Failed to provide the user’s manager with read-only access to the user home folder. Reason: The user’s manager is not specified in the directory.
In accord with policy, the user home folder will be deleted when the user account is deleted. Home folder name: name	Not applicable
The required users and groups are provided with read-only access to the user home folder. List: Users and groups	Failed to provide the required users or groups with read-only access to the user home folder. List: Users and groups
The new owner is assigned to the user home folder. Owner name: name	Failed to assign the new owner to the user home folder. Failed to set this owner name: name

Related Documents

© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy