Chat now with support
Chat with Support

Identity Manager 8.2.1 - Administration Guide for Active Roles Integration

One Identity Active Roles integration Synchronizing Active Directory using One Identity Active Roles Interaction with Active Roles workflows Interaction with Active Roles policies Managing Active Directory objects Configuration parameters for managing an Active Directory environment Default project template for One Identity Active Roles Active Roles connector settings

Restoring deprovisioned Active Directory user accounts and Active Directory groups in the One Identity Manager

You can restore deprovisioned Active Directory user account and Active Directory groups using One Identity Manager if required. The following methods are used to do this:

  • Undo deprovisioning

  • Restoring deleted objects

Both methods initiate a process for deprovisioning Active Directory objects in Active Roles. The process finds the deprovisioning status, updates some of the Active Directory object properties, like the name and the Active Directory container and in the One Identity Manager database, and sets the Active Directory object status to changed. All the Active Directory object properties are loaded in the One Identity Manager database by the next synchronization and the status is changed to published.

Detailed information about this topic

Deprovisioning Active Directory user accounts and Active Directory groups

Use this method to undo Active Directory user account and Active Directory group deprovisioning. You can use this method independent of the deprovisioning method implemented.

To undo Active Directory user account deprovisioning

  1. In the Manager, select the Active Directory > User accounts > Deprovisioned accounts category.

  2. Select the user account in the result list.

  3. Select the Undo deprovisioning task.

  4. Confirm the security prompt with Yes.

  5. Confirm with OK.

To undo Active Directory group deprovisioning

  1. In the Manager, select the Active Directory > User accounts > Deprovisioned groups category.

  2. Select the group in the result list.

  3. Select the Undo deprovisioning task.

  4. Confirm the security prompt with Yes.

  5. Confirm with OK.

Related topics

Restoring deleted objects

You can use this method as an alternative for Active Directory user accounts and Active Directory groups you have deprovisioned using the method Deprovision not delete. You find the deprovisioned Active Directory object, in this case, in the One Identity Manager database with status Deleted.

To restore a user account

  1. In the Manager, select the Active Directory > User accounts category.

  2. Select the user account in the result list.

  3. Click in the result list.

To restore a group

  1. In the Manager, select the Active Directory > Groups category.

  2. Select the group in the result list.

  3. Click Undo delete in the result list toolbar.

Related topics

Configuration parameters for managing an Active Directory environment

The following configuration parameters are available in One Identity Manager after the Active Directory Module and the Active Roles Module have been installed.

Table 10: Configuration parameters
Configuration parameters Description

QER | ITShop | AutoPublish | ADSGroup

Preprocessor relevant configuration parameter for automatically adding Active Directory groups to the IT Shop. If the parameter is set, all groups are automatically assigned as products to the IT Shop. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

QER | ITShop | AutoPublish | ADSGroup | AutoFillDisplayName

The configuration parameter specifies whether the template should be applied to the ADSGroup.DisplayName column.

QER | ITShop | AutoPublish | ADSGroup | ExcludeList

List of all Active Directory groups that must not be automatically assigned to the IT Shop. Each entry is part of a regular search pattern and supports regular expression notation.

Example:

.*Administrator.*|Exchange.*|.*Admins|.*Operators|IIS_IUSRS

TargetSystem | ADS

Preprocessor relevant configuration parameter for controlling database model components for Active Directory target system administration. If the parameter is set, the target system components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | ADS | Accounts

Allows configuration of user account data.

TargetSystem | ADS | Accounts | InitialRandomPassword

Specifies whether a random password is generated when a new user account is added. The password must contain at least those character sets that are defined in the password policy.

TargetSystem | ADS | Accounts | InitialRandomPassword | SendTo

Employee to receive an email with the random generated password (manager cost center/department/location/business role, employee’s manager or XUserInserted). If no recipient can be found, the password is sent to the address stored in the configuration parameter TargetSystem | ADS | DefaultAddress.

TargetSystem | ADS | Accounts | InitialRandomPassword | SendTo | MailTemplateAccountName

Mail template name that is sent to supply users with the login credentials for the user account. The Employee - new user account created mail template is used.

TargetSystem | ADS | Accounts | InitialRandomPassword | SendTo | MailTemplatePassword

Mail template name that is sent to supply users with the initial password. The Employee - initial password for new user account mail template is used.

TargetSystem | ADS | Accounts | MailTemplateDefaultValues

Mail template used to send notifications about whether default IT operating data mapping values are used for automatically creating a user account. The Employee - new user account with default properties created mail template is used.

TargetSystem | ADS | Accounts | NotRequirePassword

Specifies whether a password is required when creating new Active Directory user accounts in One Identity Manager. If the configuration parameter is not set, entry of a password that meets the defined password guidelines is requested when a new Active Directory user account is created. If the configuration parameter is set, it is not necessary to specify a password when creating new Active Directory user accounts.

TargetSystem | ADS | Accounts | PrivilegedAccount

Allows configuration of privileged Active Directory user account settings.

TargetSystem | ADS | Accounts |
PrivilegedAccount | SAMAccountName_Postfix

Postfix for formatting the login name of privileged user accounts.

TargetSystem | ADS | Accounts | PrivilegedAccount |
SAMAccountName_Prefix

Prefix for formatting a login name of privileged user accounts.

TargetSystem | ADS | Accounts | ProfileFixedString

Fixed string appended to the default profile path of a user profile.

TargetSystem | ADS | Accounts | TransferJPegPhoto

Specifies whether changes to the employee's picture are published in existing user accounts. The picture is not part of default synchronization. It is only published when employee data is changed.

TargetSystem | ADS | Accounts | TransferSIDHistory

Specifies whether the SID history is loaded from the target system.

TargetSystem | ADS | Accounts | TSProfileFixedString

Fixed string appended to the default profile path of a user profile on a terminal server.

TargetSystem | ADS | Accounts | UnlockByCentralPassword

Specifies whether the employee's Active Directory user account is unlocked when the central password is synchronized.

TargetSystem | ADS | Accounts | UserMustChangePassword

Specifies whether the Change password at next login option is enabled when a new user account is created.

TargetSystem | ADS | ARS

Preprocessor relevant configuration parameter to control the database model components for supporting Active Roles. If the parameter is set, Self-Service Management components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | ADS | ARS_SSM

Preprocessor relevant configuration parameter for controlling the database model components for One Identity Active Roles Self-Service Manager in the One Identity Manager IT Shop. If the parameter is set, Self-Service Management components are available. Changes to this parameter require the database to be recompiled.

If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.

TargetSystem | ADS | AuthenticationDomains

Pipe (|) delimited list of domains to be used by the manual Active Directory authentication module to authenticate users. The list is processed in the given order. This list should only contain domains to be synchronized.

Example:

MyDomain|MyOtherDomain

For more information about One Identity Manager authentication modules, see the One Identity Manager Authorization and Authentication Guide.

TargetSystem | ADS | AutoCreateDepartment

Specifies whether departments are automatically created when user accounts are modified or synchronized.

TargetSystem | ADS | AutoCreateLocality

Specifies whether locations are automatically created when user accounts are modified or synchronized.

TargetSystem | ADS | AutoCreateHardwaretype

Specifies whether corresponding device types are created automatically in the database for imported printer objects.

TargetSystem | ADS | AutoCreateServers

Specifies whether entries for missing home servers and profile servers are created automatically when user accounts are synchronized.

TargetSystem | ADS | AutoCreateServers | PreferredLanguage

Language of automatically created servers.

TargetSystem | ADS | DefaultAddress

Default email address of the recipient for notifications about actions in the target system.

TargetSystem | ADS | HardwareInGroupFromOrg

Specifies whether computers are added to groups based on group assignment to roles.

TargetSystem | ADS | MaxFullsyncDuration

Maximum runtime of a synchronization in minutes. No recalculation of group memberships by the DBQueue Processor can take place during this time. If the maximum runtime is exceeded, group membership are recalculated.

TargetSystem | ADS | MembershipAssignCheck

Specifies whether membership validity is verified on saving when group memberships are assigned in the One Identity Manager database.

Disable this configuration parameter if several trusted domains with access across memberships are managed in the database.

TargetSystem | ADS | MemberShipRestriction

General configuration parameter for restricting membership in Active Directory.

TargetSystem | ADS | MemberShipRestriction | Container

Number of Active Directory objects allowed per container before warning email is sent.

TargetSystem | ADS | MemberShipRestriction | Group

Number of Active Directory objects allowed per group before warning email is sent.

TargetSystem | ADS | MemberShipRestriction | MailNotification

Default mail address for sending warning emails.

TargetSystem | ADS | PersonAutoDefault

Mode for automatic employee assignment for user accounts added to the database outside synchronization.

TargetSystem | ADS | PersonAutoDisabledAccounts

Specifies whether employees are automatically assigned to disabled user accounts. User accounts are not given an account definition.

TargetSystem | ADS | PersonAutoFullSync

Mode for automatic employee assignment for user accounts that are added to or updated in the database by synchronization.

TargetSystem | ADS | PersonExcludeList

List of all user accounts that must not be automatically assigned to employees. Names are listed in a pipe (|) delimited list that is handled as a regular search pattern.

Example:

ADMINISTRATOR|GUEST|KRBTGT|TSINTERNETUSER|IUSR_.*|IWAM_.*|SUPPORT_.*|.* | $

TargetSystem | ADS | PersonUpdate

Specifies whether employees are updated if their user accounts are changed. This configuration parameter is set to allow person objects to be updated continually from linked user accounts.

TargetSystem | ADS | ReplicateImmediately

Speeds up synchronization of modifications between two domain controllers When set, the accumulated modifications in Active Directory are immediately replicated between domain controllers.

TargetSystem | ADS | VerifyUpdates

Specifies whether changed properties are checked when the system is updated. If this parameter is set, the objects in the target system are verified after every update.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating