Setting target system as real readonly

Question

I'm working now on 7.1.1 
 
 I've seen, that the Sync Project defines now two readonly flags. One for the connection to OIM and one to the target system. 
 To have the Targetsystem as readonly I have to set the readonly flag for the target system. 
 
 This works fine for the synch (Target --> OIM). 
 But provisioning (OIM --> Target) jobs are still created since the NamespaceManagedBy is set to 'VISYNC'. 
 The provisioning jobs will end in a FROZEN afterwards since the target system connection is set to readonly. But I want to have the possibility to switch a specific target to readonly without cleaning up a lot of frozens. 
 
 Therefore I think setting the NamespaceManagedBy from 'VISYNC' to 'READONLY' would be the correct approach, but the Manager doesn't allow me to do that change. (The change in the other direction was ok) 
 
 Finally my question: 
 Is it a good idea to switch readonly on/off via SQL on the NamespaceManagedBy field? 
 
 PS: 
 The other option would be to deal with the entries in DPRObjectOperation, but that wouldn't be real fun.

Markus Weiss-Ehlers · Accepted Answer

The provisioning jobs have been created because you do have the Ad-Hoc workflows in your sync project. In that case, the read-only can be used as a quick switch to disable all write operations to the target system, but being able to re-activate the process steps later on, when you set the target system connection to writeable again. 
 If you want to disable the generation of your provisioning processes for some or all of the objects in your synchronization project, just remove or disable the workflow steps that write the objects to the target system (see screenshot).