Active Directory Manager still seeing disabled users under their direct reports.

[Santosh]

Hello there, we have a requirement to keep the terminated users as disabled for 6 months in AD and we do the cleanup afterwards, but we don't want those disabled users to be showing up under Manager's Direct reports/organization on Active Directory. Our DISABLEACCOUNTJSON is,

{"moveUsertoOU": "OU=SAVIYNT_TEST_DISABLED_OU_USER", .........XXXXXXX.............."
"deleteAllGroups": "NO",
"userAccountControl": "514",
"manager": NULL
}

I have tried "manager":null and "manager":"" and I'm getting a error message as follows,

Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value

[rushikeshvartak]

{
"moveUsertoOU": "OU=SAVIYNT_TEST_DISABLED_OU_USER",
"deleteAllGroups": "NO",
"userAccountControl": "514",
"manager": {
"operation": "remove"
}
}

[Santosh]

Tried that, got following error,

Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value

[rushikeshvartak]

{
"moveUsertoOU": "OU=SAVIYNT_TEST_DISABLED_OU_USER",
"deleteAllGroups": "NO",
"userAccountControl": "514",
"manager": null
}

[Santosh]

@rushikeshvartak I have tried "manager": null and "manager": "" Infact that was 1st thing I tried as I set the pass string on connection params to TRUE.  NULL didn't help either along with 

"manager": {
"operation": "remove"
} 

I'm thinking if, instead of "remove", can we do "DELETE"?

[rushikeshvartak]

It should be null and not NULL

[Santosh]

@rushikeshvartak yes tried passing "manager":null . Infact, this was the 1st thing I tried. We also have,

SUPPORTEMPTYSTRING Set to TRUE to send an empty value or null string during provisioning. Default value is FALSE.

TRUE

and yet the issue holds the same.

[rushikeshvartak]

Can you share logs

[Santosh]

This is the provisioning comment, and I have attached the log below as well.

Not sure this history key will help sort out the log but here i included this as well (historyKey : e1fbff46749b4b05a97e96d12294574a)

Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value

[rushikeshvartak]

"manager": ""

[Santosh]

@rushikeshvartak as you can see on my post and couple responses above, I have already tried that, and it still gave the same error as above. I can try again, if it behaves differently this time.

[Santosh]

Well still the same thing with "manager": ""

Error while Delete operation for account-stester in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091207, comment: Error in attribute conversion operation, data 0, v4563] Error while Delete operation for account-stester in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091207, comment: Error in attribute conversion operation, data 0, v4563]