https://www.oneidentity.com/community/active-roles/en-USTelligent Community 13https://www.oneidentity.com/community/active-roles/f/forum/36999/dynamic-group---update/92958Sun, 13 Sep 2026 09:10:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:758dc15c-3b97-49d0-b8aa-c9d6436d52fdpramkrisDoes the above still apply for v8.6? Does it still log an event (2589) for the manual DG rebuild trigger? I see an event 2692 for successful accountNameHistory attribute update for a DG but don't see the 2589 event? The metadata of the group member does not update either, so not sure if the manual DG rebuild is working as expected?https://www.oneidentity.com/community/active-roles/f/forum/39699/ar-powershell-scripts-and-o365-tenants---service-principals-vs-managed-identities/92956Fri, 11 Sep 2026 11:16:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:a922798d-e68b-492b-9547-3e71c8d550b1aron cseuzHi Johnny, Sebestyen nailed the mechanism: a Managed Identity isn't the host's identity and isn't passed by the runspace — it's a token fetched from the local IMDS endpoint. So it only works where that endpoint exists: • On-prem: no endpoint, so it always fails (Script Activities and Scheduled Tasks alike). Stick with the service-principal + certificate pattern — it's still fully supported. • Azure VM: IMDS at 169.254.169.254 is reachable by any process on the box, so AR can use it. Authenticate directly against it, e.g. Connect-MgGraph -Identity (Microsoft.Graph/Az modules only — legacy MSOnline/AzureAD don't support MI), and grant the MI the Graph permissions explicitly. • Azure Arc server: also works, but via a different endpoint that needs extra rights on the service account. Quick test — drop this in a Script Activity; a token back means IMDS is reachable: Invoke-RestMethod -Headers @{Metadata='true'} -Uri '169.254.169.254/.../token Hope that helps, Aronhttps://www.oneidentity.com/community/active-roles/f/forum/39957/is-the-username-generation-button-broken-in-8-5/92955Fri, 11 Sep 2026 11:07:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:82a2dc56-f84f-49e6-9d75-ca92a7082590aron cseuzHi Charlene, That message on the policy's General tab — "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error." — is the key here. The Generate button next to the User logon name field only appears when the MMC Console can successfully load and evaluate that policy. Since the console can't evaluate it, it doesn't render the button. The Web Interface uses a different code path, which is why it still works there. A few things worth checking before assuming it's a product bug: 1. Console vs. Service version. After an upgrade this is the most common cause — the MMC Console is often left on the older build while the Administration Service is on 8.5. Check the version in the Console's Help → About and compare it to the Administration Service version; they should match. If the console wasn't upgraded, reinstall/upgrade it to 8.5. 2. The actual exception. The General-tab message is just the surface. Look in the Application event log on the Administration Service server (source: ARAdminService) at the moment you open the policy — that entry will contain the real error (e.g. a missing attribute, a script error, or a migration issue). That's what determines whether this is a config problem or a genuine defect. 3. Rule/attribute migration. If the generation rule references a script or a virtual/custom attribute, it's worth confirming that attribute still exists and resolves after the upgrade. Recreating the rule (which you've already tried) won't help if the underlying dependency is missing. If you can share the exact error from the Application event log (or the full text from the policy's General tab), it'll be much easier to pin down whether this is environmental/migration-related or something that needs to be raised with Support. Thanks, Aronhttps://www.oneidentity.com/community/active-roles/f/forum/39953/remove-users-from-some-groups-but-not-all/92953Thu, 10 Sep 2026 11:11:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:ad09582a-c132-45e6-a47e-9a6f7c2cdbbearon cseuzHi Sander, This is doable with a scheduled workflow in Active Roles. The trick is that a scheduled workflow starts with no target object, so you drive it yourself: 1. Search activity – scope it to your specific OU and filter for user objects. This iterates over every user in that OU and runs the child activities once per user. 2. Script activity (inside the Search activity) – this does the real work: it looks at the user's group memberships and removes only the groups that match your rule. The most important design decision is how you define "some groups but not all." A scheduled job has no way to guess — you need an explicit rule. Common options: • Groups whose name matches a pattern (e.g., start with APP- or Temp- ). • Groups that live in a specific OU/container. • Groups listed in a config (a Virtual Attribute, a text file, or hard-coded array). Example script activity (PowerShell / Management Shell style) that removes only groups matching a name prefix: function onPreExecute($Request) { # The user currently being processed by the parent Search activity $user = $Request.TargetObject # Define your rule for "some groups": e.g. only APP-* groups $prefix = "APP-" # Enumerate the user's direct group memberships $groups = $user.Get("memberOf") foreach ($groupDN in @($groups)) { $group = $Request.GetObjectByDN($groupDN) if ($group.Name -like "$prefix*") { # Remove the user from this group only $group.Remove("CN=Users,$($user.DN)") # or use RemoveMember $group.SetInfo() } } } (Adjust the enumeration/removal calls to your Active Roles version — Get("memberOf") + Group.Remove() / SetInfo() on the ADSI object, or the ARS Remove-QADGroupMember cmdlet if you prefer the Management Shell.) 3. Schedule – on the workflow's start conditions, choose "Run this workflow on a schedule" and set your recurrence (daily/weekly). A few tips: • Enumerate memberOf and remove based on your rule — never remove all groups; the whole point is the filter decides which ones go. • Test against a single test user / a lab OU first, and log what would be removed before you actually remove it. • If your "which groups" list is dynamic, store it in a Virtual Attribute or a small config file so you don't have to edit the workflow to change it.https://www.oneidentity.com/community/active-roles/f/forum/39979/windows-server-2025---core/92951Wed, 09 Sep 2026 12:50:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:945bf3c4-c29d-4967-9586-3ae6daf3f49dcraig mcfarlaneThanks for the reply. Thats a shame, really trying to reduce our GUI use.https://www.oneidentity.com/community/active-roles/f/forum/39979/windows-server-2025---core/92950Wed, 09 Sep 2026 12:42:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:ac472e2b-203b-4bad-bd77-f71c8a84703cTerrance.CrombieWindows Core is not currently a supported platform for Active Roles. Support for it is being tracked as Enhancement ID 90625.https://www.oneidentity.com/community/active-roles/f/forum/39979/windows-server-2025---coreWed, 09 Sep 2026 12:29:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:e61943f1-9851-407c-817a-cab5b254d6c1craig mcfarlaneHi. Can anyone confirm if ARS Admin and Web Interface can be installed on 2025 Core? I see 2025 is supported but i don't see anything in the requirement to specifically call out Core edition You can install any of the Active Roles components on a computer running: Microsoft Windows Server 2025 Microsoft Windows Server 2022 Microsoft Windows Server 2019 Microsoft Windows Server 2016https://www.oneidentity.com/community/active-roles/f/forum/39957/is-the-username-generation-button-broken-in-8-5Wed, 19 Aug 2026 08:57:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:792dfe81-d284-4659-accf-7514d1f2f16bcharleneforbesHi, Since we updated to 8.5 the mmc console doesn't show the username generation button, has anyone else seen this? The web console still has it, and it works, but the mmc console doesn't. I've recreated the rule and that hasn't helped, and when I create it there's a message in the General tab of the policy saying "Provisioning policy failure. The 'User Logon Name Generation' policy encountered an error." Has anyone else found this?8.5Active Roleshttps://www.oneidentity.com/community/active-roles/f/forum/39953/remove-users-from-some-groups-but-not-allFri, 14 Aug 2026 15:30:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:fec58f6e-7327-4b9f-9665-0fc70040c18csander.martijnHi, I am looking for a way to remove some groups from a user but not all. The workflow should be a scheduled workflow which is linked to a specific OU. Does anyone has any examples or ideas on how to do this? Any help is much appreciated. Sanderhttps://www.oneidentity.com/community/active-roles/f/forum/39930/unable-to-delete-computer-objects-since-updating-to-8-5/92896Fri, 14 Aug 2026 14:33:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:81856ed7-71ee-4ccb-ae3c-589472b53d29frank hardwick_20260206090112I'm wrestling with this issue with a client that just upgraded to 8.2.1 and is planning to not upgrade too soon since this one was bumpy.https://www.oneidentity.com/community/active-roles/f/forum/39930/unable-to-delete-computer-objects-since-updating-to-8-5/92895Fri, 14 Aug 2026 12:28:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:3d468d1b-998e-429b-b861-9aebb22e0609leejohncYes correct, i checked them on the DC as well using the native tools. All replied false.https://www.oneidentity.com/community/active-roles/f/forum/39930/unable-to-delete-computer-objects-since-updating-to-8-5/92894Fri, 14 Aug 2026 12:27:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:f59f319b-ebec-4799-aab8-1f5053f24c64JohnnyQuestYou looked at the native ACLs right? I believe the problem resides in the "virtual ACL" in the AR database.https://www.oneidentity.com/community/active-roles/f/forum/39930/unable-to-delete-computer-objects-since-updating-to-8-5/92886Thu, 13 Aug 2026 15:59:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:973ce44d-ab61-4ac6-a0b9-5910f05cf7bdleejohncI looked at the ACL's of both the parent computer objects, and leaf object or objects. In my use case, the parent object, nor it's leaf objects had the protection turned on. $Children = Get-QADObject ` -SearchScope OneLevel ` -SearchRoot $Computer.DN ` -IncludedProperties ProtectedFromAccidentalDeletion ` -Connection $Connection foreach($Object in $Children){ (Get-Acl "AD:$Object").Access | Format-Table ` IdentityReference, AccessControlType, ActiveDirectoryRights, IsInherited -AutoSize Get-QADObject $Object -IncludedProperties ProtectedFromAccidentalDeletion -Connection $Connection | select name,ProtectedFromAccidentalDeletion } I was able to successfully delete the object using the cmdlet on this object, but as the other commenters mentioned, the ARS MMC throws an error.https://www.oneidentity.com/community/active-roles/f/forum/39930/unable-to-delete-computer-objects-since-updating-to-8-5/92885Thu, 13 Aug 2026 15:48:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:6c78a131-98d2-48fa-aa76-9d7d92015366JohnnyQuestI'm guessing this won't work because it's been my understanding that the issue resides within the Admin Service. Others have reported that their Admin Service user can natively delete the computers (i.e. when you do RunAs with ADUC). My suspicion is that there's a wayward deletion protection flag that somehow got set in the Admin Service DB.https://www.oneidentity.com/community/active-roles/f/forum/39930/unable-to-delete-computer-objects-since-updating-to-8-5/92884Thu, 13 Aug 2026 12:47:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:74b53602-c1b9-4af9-af79-678e677a82b1leejohnc@craig mcfarlane What happens if you do this in a powershell? $service="FQDN of Active Roles Admin Server" $computerOjbect="some computer samaccountname" $Connection = Connect-QADService ` -Proxy ` -Service $service $Computer = Get-QADComputer ` -Identity $ComputerObject ` -Connection $Connection Remove-QADObject -Identity $Computer.DN ` -Connection $Connection ` -Force ` -DeleteTreehttps://www.oneidentity.com/community/active-roles/i/ideas/is-there-a-way-to-add-membership-rules-with-powershell-to-a-dynamic-groupWed, 05 Aug 2026 20:22:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:dfa3377c-84af-4184-bd79-69b5d08cc636sean rogersHere is the scenario...We have a ton of dynamic groups and some of them might have 10+ rules assigned to them with a lot of them being "Include by Query". Here is my issue, when we have changes as far as the naming of attributes that are used for these rules, it's a big pain to go in and update the dynamic groups. For one, under membership rules it just shows you "users, contacts and groups" and you have to open each one to determine which one needs to be updated. But we have run into scenarios were lets say the 10 rules for one dynamic group, all 10 of those rules, the names will be changing so now we have to add 10 additional rules with the new names so that way when the attribute name changes, users stay in the group and don't get removed. So my question is, is there a way that we could make these changes with powershell or make bulk changes for adding or removing rules?https://www.oneidentity.com/community/active-roles/f/forum/39931/upgrade-db-from-8-2-to-8-3/92847Fri, 31 Jul 2026 13:44:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:c7b674c9-870b-423f-a4c2-fbe0bdc03a0dzsolt dunaiHi fabien covez , To narrow this down — how did you perform the upgrade? a) In‑place upgrade: Did you run the 8.3 installer on the existing server and click Upgrade? After the reboot, the Active Roles Configuration Center should start and run the upgrade, which creates the new 8.3 database(s) and migrates your previous version's data automatically (your old database is kept intact). The "version mismatch" message usually means the new service was pointed at the un‑upgraded 8.2 database directly, instead of letting this wizard run. b) Fresh install (old version removed): In Configuration Center → Administration Service → Active Roles databases, click Change to create the new 8.3 database, then on the same page use Import configuration to bring your 8.2 configuration/data across. A couple of details that would help me pinpoint it: Guides: • In‑place upgrade: docs.oneidentity.com/.../upgrade-in-place.htm • Configuring during in‑place upgrade: docs.oneidentity.com/.../upgrade-in-place-configuration.htm • Import configuration: https://docs.oneidentity.com/bundle/active-roles_upgrade-guide_8.3/page/guides/upgradegu ge-config-ars-import-config-data.htm Cheers, Zsoltihttps://www.oneidentity.com/community/active-roles/f/forum/39936/ar-management-shell---remote-server-not-connecting/92846Thu, 30 Jul 2026 19:05:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:87486cf3-34ab-4b4f-9af8-bf9c6d67b0eacraig mcfarlaneRichard you legend. It was Active Roles ADSI Provider that did it. My VS was up to date as running on Windows Server 2025 but ADSI is made it work. Honestly as always really appreciate your help and timehttps://www.oneidentity.com/community/active-roles/f/forum/39936/ar-management-shell---remote-server-not-connecting/92845Thu, 30 Jul 2026 18:53:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:78f8aa92-5756-4521-bbe1-e71c3f0549b0Richard LambertHave a look at this KB to see if any of the required components might be missing on the host where the remote connection is initiated from: Connect-QADService: Invalid syntax (4250140)https://www.oneidentity.com/community/active-roles/f/forum/39936/ar-management-shell---remote-server-not-connecting/92844Thu, 30 Jul 2026 18:50:00 GMT5f2f4fa7-ebc7-4803-900c-42d427844a5e:bc11a079-83fd-4ebc-9cbf-87aa0724d188craig mcfarlaneThanks Richard. Sorry i should have said i did try the -Proxy switch and get Connect-QADService : Invalid syntax (Exception from HRESULT: 0x800401E4 (MK_E_SYNTAX)) I am logged on to my remote server with an account that has right in ARS as i can open the MMC and do what i have set. Even just running the command below gives me the error above Connect-QADService -Proxy -Service "SERVERNAME"