Active Directory Manager still seeing disabled users under their direct reports.

[Santosh]

Hello there, we have a requirement to keep the terminated users as disabled for 6 months in AD and we do the cleanup afterwards, but we don't want those disabled users to be showing up under Manager's Direct reports/organization on Active Directory. Our DISABLEACCOUNTJSON is,

{"moveUsertoOU": "OU=SAVIYNT_TEST_DISABLED_OU_USER", .........XXXXXXX.............."
"deleteAllGroups": "NO",
"userAccountControl": "514",
"manager": NULL
}

I have tried "manager":null and "manager":"" and I'm getting a error message as follows,

Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value

[rushikeshvartak]

{
"moveUsertoOU": "OU=SAVIYNT_TEST_DISABLED_OU_USER",
"deleteAllGroups": "NO",
"userAccountControl": "514",
"manager": {
"operation": "remove"
}
}

[Santosh]

Tried that, got following error,

Error while Delete operation for account-stesting in AD - Malformed 'manager' attribute value

[rushikeshvartak]

{
"moveUsertoOU": "OU=SAVIYNT_TEST_DISABLED_OU_USER",
"deleteAllGroups": "NO",
"userAccountControl": "514",
"manager": null
}

[Santosh]

@rushikeshvartak I have tried "manager": null and "manager": "" Infact that was 1st thing I tried as I set the pass string on connection params to TRUE.  NULL didn't help either along with 

"manager": {
"operation": "remove"
} 

I'm thinking if, instead of "remove", can we do "DELETE"?

[rushikeshvartak]

It should be null and not NULL

[Santosh]

@rushikeshvartak yes tried passing "manager":null . Infact, this was the 1st thing I tried. We also have,

SUPPORTEMPTYSTRING Set to TRUE to send an empty value or null string during provisioning. Default value is FALSE.

TRUE

and yet the issue holds the same.

[rushikeshvartak]

Can you share logs

[Santosh]

This is the provisioning comment, and I have attached the log below as well.

Not sure this history key will help sort out the log but here i included this as well (historyKey : e1fbff46749b4b05a97e96d12294574a)

Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value Error while Delete operation for account-swednesday in AD - Malformed 'manager' attribute value

[This message has been edited by moderator to mask sensitive info]

[rushikeshvartak]

"manager": ""

[Santosh]

@rushikeshvartak as you can see on my post and couple responses above, I have already tried that, and it still gave the same error as above. I can try again, if it behaves differently this time.

[Santosh]

Well still the same thing with "manager": ""

Error while Delete operation for account-stester in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091207, comment: Error in attribute conversion operation, data 0, v4563] Error while Delete operation for account-stester in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091207, comment: Error in attribute conversion operation, data 0, v4563]

[AliW]

Hi, 

I'm having the same issue as well. I want to "clear" an attribute as part as of a disableaccount/enableaccount being run.

I've tried all the suggestions outlined in this forum post and I am getting the same behaviour as @Santosh has reported.

What is the correct way of clearing an attribute?

Thanks.

[rushikeshvartak]

Seems no solution -https://forums.saviynt.com/t5/identity-governance/how-to-clear-manager-field-while-disabling-user-ad-account/m-p/33468#M18533