• Active Roles 8.0 LTS - Additional languages


    I was wondering when the language pack for the 8.0 LTS version also will include the Nordic languages. Is that scheduled to be added in the near future?

    Best regards


  • Dynamic Groups and AD "Version Store"

    We have over 600 Dynamic Groups and some of them have a lot of members, ranging from 50-60K to a few that are over 200K. When the Dynamic Group Updater scheduled task runs at 3 am, the domain controller that the ARS server uses runs out of "Version Store…

  • Dynamic Group Executing server

    Hello Experts,

    I have a need to ensure all Dynamic groups are executing off of only 3 servers in my environment.

    I have 6 ARS servers and have a script to move them to the other servers not a problem. I'm wondering if there is a policy or a workflow that…

  • KB5020276—Netjoin: Domain join hardening change breaks ARS allow domain join

    I've opened a support request up with One Identity already but  wanted to see if anyone here has seen this yet. October client patches from MS have a domain join hardening update.  In a nutshell if the account doing the join to an existing object in…

  • Exchange Online Management module not loading in Active Roles

    I'm unable to connect to Exchange Online Management module from the Active roles.

    I've used 'O365 script execution configuration' in the Active Roles Workflow.

    Do let me know if you need more information around this.


  • Change Workflow not triggering in OnPostUndoDeprovision


    I've created a change workflow when 'Account Is Disabled' attribute changes, then the workflow sets an user created Virtual attribute. But in OnPostUndoDerovision of an user account workflow trigger is not happening, usually when undo deprovision…

  • Allow Delegated IT Staff to Unmap Accounts (Synchronization Service) or Script it


    I am looking for ideas on how to best allow other IT team members to "unmap" Active Directory accounts from various Synchronization Service Workflows.  Currently only ARS Admins have the ability to do this but I would like to extend this…

  • LastloginTimestamp attribute - undo deprovision scenario


    We are having problem that layout below.

    1. If user passes 120 days based on lastlogintimestamp attribute and once passed deprovisioning the user using a daily script.
    2. Later point of time if we want the user back then we are doing undo deprovision…
  • Change UTC time to Pacific in Active Roles


    I would like to change all the datetime stamps from UTC to Pacific in Active Roles tool. Where I configure the same to reflect the change.

    For example, in change history or run history, started date or completed date. Usually it shows UTC but I…

  • 'Parsing WS-Trust response failed' error_Connecting to Azure from PowerShell


    I'm seeing below error when I connect Azure AD. Using 'Connect-AzureAD -Credential $credObj' from PowerShell ISE.

    Could anyone please help me here.

    Connect-AzureAD : One or more errors occurred.: parsing_wstrust_response_failed: Parsing…

  • Get-QARSOperation not working in Prod OnPostUndelete Event


    I'm unable to run the 'Get-QARSOperation' cmdlet in production active roles console in the onpostundelete event. Do I need to do anything before run the cmdlet.

    But I'm able to run same in Powershell command prompt and Powershell ISE…

  • Restore Event for Delete Objects container


    Do we have any event for restore deleted object? When I click on the restore option on right click of an object in the deleted objects container, event should trigger the event.



  • Update AD users employeenumber based on csv file

    I am currently using a workflow to update from field EmployeeID to EmployeeNumber.  Basically I am adding a letter in front of the employeeID to create employeeNumber.

    Ex. employeeID "123456" become employeeNumber "A123456"

    it working…

  • Update Virtual attribute value based on another Virtual attribute value change.


    I'm having a requirement, we created couple of Virtual attributes in Active Roles and if we change a value of VA1 and then dynamically update the value of VA2. 

    VA1 - Dropdown field

    VA2 - String field

    Do let me know if you need more information…

  • How do I call the value of a policy object custom parameter value inside the script called from the policy?

    Searching the forum returned a buffet of 'not exactly it' - 

    in a nutshell "How do I access the policy parameter from within the script module called by the policy under the administration node"

    I have a policy, calling a policy script…

  • Virtual Attribute default value

    Hello Community,

    Does anyone know if there is a way for a virtual attribute to have a default value when a user get's synced in from AD?

    I have a need for a boolean value for users and when a new user is created from One Identity manager to make that…

  • When ARS is not a domain admin, using builtin 'administrators' - what granular permissions required to deProvision to target OU.

    Our Service Account wasdomain admin until the earth moved.  Now we run as builtin administrators.  What native granular permissions are required on object to deprovision, the losing OU and then winning OU as part of the deprovision process.

    We see a failure…

  • User Deprovisioning - Remove from all Azure Groups


    We're currently working on our user deprovisioning processes and have an issue I am hoping someone can help us with.

    We are currently in a hybrid model (on premise AD synced to Azure using AD Connect).

    The issue we face is that when a user leaves…

  • Disk space in Active Roles Server is getting low in storage due to ongoing SQL Server Database Transaction Log file

    The disk space in Active Roles Server is getting low in storage.


    The disk space in Active Roles Server is getting low in storage , we have upgraded to 2TB , but the logs are increasing , below are the logs that is filling up the disk…

  • Set the edsvaDeprovisionDeletionDate attribute value in powershell

    I've a requirement to set the edsvaDeprovisionDeletionDate attribute value with future datetime using powershell code and its GeneralizedTime datatype. So I'm unable to set the value to the attribute using powershell. Could anyone please help me to…

  • Active Roles - The connection with the remote endpoint was terminated


    We are running Active Roles Server via 2 web servers which connect to 2 backend application servers, all running Windows Server 2016. Every 2-3 days we're getting an error on one of the web servers that "An error occurred during the last operation…

  • Managed Domains

    We have setup ARS on domain ABC and its working fine using a service account with domain admin permission. 

    Additionally we have added domain XYZ with a separate domain admin account however when we try to create a user we get the following error: 


  • Automating user process - retrieve initial password


    We have setup some new user automation however we would like to store the users initial password somewhere so that we can then send this via email to the IT Technician setting up the users account.

    Does anyone know where this attribute is stored…

  • ARS 7.4.3 Slow WebUI Performance

    We've been noticing slow WebUI performance, particularly in the chromium browsers.  The search results, and action panes take a long time to render (20 seconds or so).  There does not seem to be any real load on the web/admin servers (6 CPU's/24GB of…

  • How to access container in Active Directory using PowerShell


    I would like to restore the deleted objects from the Deleted Objects container. I'm looking for a PowerShell script cmdlet or script.

    Appreciate for the help in advance.