• State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 96 subscribers
  • Views 3718 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mass enablement of disabled AD accounts

IDM Engineer
over 8 years ago

Hello,

Number of disabled AD accounts got enabled. XUserInserted on the process step gives a user name but the user saying that he did not do it. Anything that may cause mass enablement of AD accounts other than user intervention. I'm not seeing any other process in the process history other than ADS_ADSAccount_Update/(De-)activate. 

Thanks

  • 0 over 8 years ago
    The AD accounts were disabled and got enabled. Then the user who did the change is to be seen in the XUserUpdated field of the ADSAccount as the account already existed and the time is to be found in the XDateUpdated.
    The process ADS_ADSAccount_Update/(De-)activate is the process that activates the the ad accounts. From the CausingEntityPatch you may find, if something else was also changed.

    There is a template on the adsaccount.accountdisabled. There are a couple of reasons that might trigger through this template a mass enablement of disabled AD accounts. Looking at the template and checking the XUserUpdated fields for those references you should find out the reason.