Active Roles Server Auto Deprovission

Question

Hello all,

With the help of members I have created a managed unit which houses users who have not logged on for over 90 days.

and alos recieved help with script/ task to auto deprovision.

However, I have come across below situation.

User's are de-provisioned over night every night.

Desk get call from manager to re-provision an account, ready for user to start in the morning or (within 5 days) they do so as requested.

task runs over night and de-provisiones the account again

How can I exclude accounts that have been reprovisioned within the last 5 days.

johnq37 · Accepted Answer

I would store the un-deprovisioned date in the VA, modify the MU script to exclude users who have a value in the VA that is within the past 5 days, and modify the Deprovision command to clear that VA.

gregvm · Answer

John posed a good question. I would add by saying that this document shows how to compare dates when building a managed unit. You can create a VA that is updated with the deprovision date and store its value in the database. Then modify the script in the document to compare today's date versus the depro date VA, adding for the time period you need (5 days).

gregvm · Answer

oops, yes I meant the Un-Depro date would need to be stored in the VA

raviraj_gawas · Answer

You can use the attribute edsvaUnDeprovisionCommand or edsvaUnDeprovisionStatus if 2 or 1 exits do not /exclude form de-provisioning user. 
so the undo deprovisioned users won't get deprovisioned again.

Endpoint Privilege Management

Active Roles Server Auto Deprovission