Archived / Suspended account query

[Adrian Simpkins]

Hi All

I wanted to see if anyone could confirm what differences there are between Suspended accounts and Archived - basically we are setting up our LDAP to suspend Service Manager basic user accounts when they AD account is closed on file, and I wanted to see what others may have done in this scenario. I know that Archiving accounts retains the associated data (we are avoiding any deletions of full User profiles to retain all history), I presume if an account is left in Suspended this will also retain any associated history.

Is the recommended state for a basic user account whose AD is closed Suspended rather than Archived? Currently we are going to Suspend Basic accounts, and manually Archive full Users to retain history, and I just wanted to see if this is the approach others have taken please

Many thanks !

[Martyn Houghton]

@Adrian Simpkins

We have an LDAP Import process which archives Hornbill accounts for all AD Accounts which have been disabled, whether the where a User or Basic account.

The only issue we have had User accounts archived before requests assigned to them have been re-assign, as the BPM cannot assign activities etc to an archived account.

Other than that we not had any issues with archiving them.

Cheers

Martyn

 

[Steve Giller]

@Adrian Simpkins The differences are documented here.

The basic difference is that a Suspended User can still be seen by other Users, an Archived User is invisible.

[Adrian Simpkins]

Hi Martyn / Steve

Thanks for the feedback, now that I know that Suspended are still visible I will look to set all to Archived instead, and just leave the Suspended status for any users having logon issues.

Many thanks, much appreciated for the pointers  

[SimonSheldon]

@Adrian Simpkins sorry to hijack but would you be able to share how you are setting this on your LDAP import? :-)

I need to do the same and have struggled to work out how to do it...

Thanks

Simon

[Martyn Houghton]

@SimonSheldon

They way we do it, is that we have two LDAP Import configurations which run sequentially.

This first imports any new or updated account which are not disabled as per a normal LDAP import process.

Followed by second one which queries all disable accounts and sets them to Archived. The later uses the query string below.

(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=2)(whenChanged>=20160101000000.0Z))

We have a date filter on it to stop it producing an error when attempting to archive an account we never created when establishing the LDAP import into Hornbill as we did not import disabled users at the start.

Then under the 'User Options' tab in the config we have it set as below.

Cheers

Martyn

[SimonSheldon]

thanks Martyn - I'll have a play (with Dryrun enabled of course! :-) )

[Adrian Simpkins]

Hi Simon

Apologies I think I had advised previously I would provide some details around our LDAP setup - I see that Martyn has provided some guidance so I will let you run with that, but of course happy to share if need be still

Many thanks

[SimonSheldon]

Thanks Adrian - I think I've got it working! 

[Adrian Simpkins]

Excellent news Simon  

[Tracey Edwards]

Hi

Can some one tell me at what point does Hornbill set a user to Archived automatically - i.e How many days of non use of account? 

Thanks

Tracey

[Steve Giller]

21 minutes ago, Tracey Edwards said:

Can some one tell me at what point does Hornbill set a user to Archived automatically

That's not something Hornbill does.

[Victor]

22 hours ago, Tracey Edwards said:

at what point does Hornbill set a user to Archived automatically

@Tracey Edwards as Steve said, there is no such functionality in Hornbill. I am curious why you would think it does that? Perhaps there is some incorrect documentation somewhere...