Ad groups affected again to a reactivated Add account

Question

Hello,

We have an issue with one identity manager..

When an Ad account having Ad groups is deactivated, it loses the AD groups to which it was belonging..

But when i manulaly re-activate the AD account (not by assignin a buisiness role) , these AD groups are re-affected to the AD account..

Is that a normal behaviour ?

How to prevent this ?

I have unchecked : <<retain groups if user account disabled>>, it s wotking because effectively, when AD account is disabled, all the AD groups disapear in OIM,

but why OIM recreate them when the AD group is enabled ?

Kind regards,

Markus Weiss-Ehlers · Accepted Answer

This is the correct and ootb behavior. The group memberships are not deleted but just marked as ineffective (IsInEffect=0) in the table ADSAccountInADSGroup to allow the re-activation of a user account with all previous memberships. 
 If you want to prevent the reactivation of these direct memberships, you need to delete these entries from the table ADSAccountInADSGroup.

Ad groups affected again to a reactivated Add account

Top Replies