Update in field XIsInEffect of table ADSAccountInADSGroup

Question

Hello, 
 I need to update the "XIsInEffect" field of the "ADSAccountInADSGroup" table. When an employee is deactivated I need to have the AD account activated and I add some AD groups and other groups are deallocated. These unassigned groups, if the employee is activated, you need to reassign them My idea is update the "XIsInEffect" field of the "ADSAccountInADSGroup" table for deallocated. But i have the error: You cannot change values of read-only objects. 
 Is it possible? 
 Greetings.

Barry Jackson · Answer

Hi, 
 You absolutely should not touch XIsInEffect directly. 
 You should use the flags on the manage levels to control this: 
 
 In my case the retain groups flags are unchecked meaning that XIsInEffect will be set to 0 in these cases. If you want to retain the group memberships you should check the retain groups boxes. Note this is for ALL groups ... you cannot retain some and not others with this approach. 
 These work off the AccountDisabled flag which OOB reacts to the IsInActive flag on the employee/identity. 
 HTH, Barry.

Barry Jackson · Answer

Hi, 
 Seems odd that the employee is deactivated but the AD account is active ...... I guess you have your reasons. 
 If you want 'some' group memberships to be retained and others to be 'removed' ...... to be put back later on employee reactivation ...... it sounds like you need to have these memberships assigned by dynamic roles. 
 HTH, Barry.

Barry Jackson · Answer

Hi, 
 Sorry but your example does not help. 
 You said: " two groups of AD by direct assignment " 
 Then you said: " Add two AD groups by indirect assignment. They add by a dynamic role that I have when a employee is desactivated " 
 
 Why are the 2 direct assigned groups added by a dynamic role when the employee is deactivated? 
 If the 2 groups are directly assigned and you want them removed when the employee is deactivated you would need to assign them via a dynamic role that is applied when the employee is active only ...... then delete the direct assignment ..... the indirect assignment will stay ..... and when the employee is deactivated the indirect assignments will be removed by the dynamic role. 
 HTH, Barry.

Barry Jackson · Answer

Hi, 
 As previously advised: 
 " If the 2 groups are directly assigned and you want them removed when the employee is deactivated you would need to assign them via a dynamic role that is applied when the employee is active only ...... then delete the direct assignment ..... the indirect assignment will stay ..... and when the employee is deactivated the indirect assignments will be removed by the dynamic role. " 
 And when the employee is activated again the groups will be re-assigned by the dynamic role. 
 HTH, Barry.

Markus Weiss-Ehlers · Answer

A solution for changing the XIsInEffect flag is proposed here https://www.oneidentity.com/community/identity-manager/f/forum/22330/event-assign-on-unsaccountbinunsgroupb-is-generated-outside-of-the-connection 
 How to delete an object in a script is explained in the SDK on the product delivery <product delivery>\Modules\QBM\dvd\AddOn\SDK\ScriptSamples\03 Using database objects\17 Delete.vb