Process Update XIsInEffect ADSAccountInADSGroup Table

Hi,

You should not be directly updating the XIsInEffect flag.  It is pretty much a 'reserved' attribute used by the object layer.

Regards, B.

But there is no way to change it via process? I need to do that for my implementation

XIsInEffect is managed by the object layer.  However if you take a look at this thread: Update in field XIsInEffect of table ADSAccountInADSGroup - Forum - Identity Manager Community - One Identity Community for some ideas on how to programmatically manage XIsInEffect.

I have an AD Group that must be assigned by default, so my thought was to put it inside a business roles. Since this AD Group enable any employee to work, I need to revoke it when the employee is on leave. This is why I was thinking to update the XIsInEffect flag. If this is not a proper action, how can I handle a situation like the one that I've desribed above?

I have an AD Group that must be assigned by default, so my thought was to put it inside a business roles. Since this AD Group enable any employee to work, I need to revoke it when the employee is on leave. This is why I was thinking to update the XIsInEffect flag. If this is not a proper action, how can I handle a situation like the one that I've desribed above?

When the employee is on leave - presumably you have some way of knowing/detecting this - set the temporary disabled flag to true.  Then in the manage level assigned to the account definition - usually 'Full managed' have the flag 'Retain groups if temporarily disabled' unchecked (false).  So, when the identity becomes temp disabled, XIsInEffect will be set to false and the account will be removed from the group - but the assignment of the group to the account will persist in ADSAccountInADSGroup.  When the temp disabled flag goes back to false, XIsInEffect will revert to true and the membership re-provisioned.  Happy days!