iden

Question

what is the importance of - XIsInEffect - in table ADSAccountInADSGroup.I could see that ,some user doesn't have any default groups.When i check in this table ADSAccountInADSGroup,i could see that the XIsInEffect value is "False". 
 But some user having True value.So i updated the value as True.Then i checked ,i could see that that group got assigned.Is it a good way or what is significance of this column " XIsInEffect ". 
 If we update this via update query,will it affect anything. 
 
 Please help me.......

Andreas Finsterbusch · Accepted Answer

You are not supposed to run update queries on columns like XIsInEffect. There is a reason you are not allowed to edit XIsInEffect via the object layer. 
 XIsIn E ffect represents whether the assignment is considered currently active. 
 e.g. an account and its memberships are freshly imported from a target system and assigned to a employee. Your OneIM installation is configured to remove memberships when a employee is temporarily deactivated. The employee gets temporarily deactivated. According to the configuration OneIM has to remove all memberships of the account while simultaneously remembering the memberships to restore them later when the employee is reactivated. While the employee is deactivated all directly assigned memberships are XIsInEffect = false.

Andreas Finsterbusch · Answer

Are those the same employees marked as security risk? 
 Check the configuration of the Manage level of the affected accounts. I assume the "Retain groups on security risk" is disabled.

Endpoint Privilege Management

iden

Top Replies