Saviynt unveils its cutting-edge Intelligence Suite products to revolutionize Identity Security!
Click HERE to see how Saviynt Intelligence is transforming the industry.
Saviynt Copilot Icon

ActiveDirectory Account Import Filter - Unexpected Accounts

BarCar
Regular Contributor
Regular Contributor

We have multiple Active Directory connections due to differing account naming rules. This was initially set up by Saviynt Professional Services.

For one set of our endpoints we are applying an OBJECTFILTER like this:

(&(objectCategory=person)(objectClass=user)(sAMAccountName=*)(!(company-SharedServices-EmployeeID=*))(!(company-SharedServices-EmployeeType=Admin*
))((EmployeeNumber=*)))

Our STATUS_THRESHOLD_CONFIG is set as follows:

{
"statusAndThresholdConfig":{
"statusColumn":"customproperty24",
"accountThresholdValue": 20000,
"activeStatus":[
"512",
"544",
"2080",
"66048",
"640",
"4194816",
"66080",
"524800",
"590336"
],
"deleteLinks": false,
"correlateInactiveAccounts": true,
"inactivateAccountsNotInFile": false
}
}

When we execute a full account import we see Saviynt report success and updates 5,357 accounts. But we see many accounts in the endpoint which should be excluded by the OBJECTFILTER - they are being updated from AD because we can see properties changing in Saviynt when the import runs.

When executing the exact same LDAP filter in PowerShell we get only 2,332 users (3k fewer):

get-aduser -server global.tektronix.net -LDAPFilter "(&(objectCategory=person)(objectClass=user)(sAMAccountName=*)(!(company-SharedServices-EmployeeID=*))(!(company-SharedServices-EmployeeType=Admin*))((EmployeeNumber=*)))" | Measure-Object | select -expandproperty count

2332

I would expect any accounts not matching the OBJECTFILTER to be marked as suspended but this is not happening. We have bumped up the threshold to 20,000 but that has had no effect.

Can anybody see what we are missing to drop these non-matching accounts from this endpoint?

14 REPLIES 14

rushikeshvartak
All-Star
All-Star
  • What is CP24 of those accounts ?

Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

In the connection ACCOUNT_ATTRIBUTE JSON we map as follows:

CUSTOMPROPERTY24::userAccountControl#String,

UserAccountControl for these extra accounts in AD are mostly "512" (which means "active"). But they don't match the OBJECTFILTER so I was expecting them to be filtered out and marked as suspended.

  • Does JOB id is latest for account which are not exist in target ?

Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

Yes - the current Job ID on the unwanted accounts is the same Job Id as the last Account import. There are later Group imports.

NM
Honored Contributor III
Honored Contributor III

@BarCar are you also importing groups from the same connection?

And are those users part of the groups?


If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'

BarCar
Regular Contributor
Regular Contributor

Yes, we are and they are - we have 3 instances of AD (one per Naming Rule) and groups are common across all instances and users from any instance can be in any group. 

  • Then those accounts are coming from other mapping maybe access import

Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

BarCar
Regular Contributor
Regular Contributor

 Ok - so is there a way to prevent the Group (Access) import from creating accounts?

No if those are part of entitlement the those will be pulled


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

Sigh. So the point of the OBJECTFILTER is what exactly?

Which accounts to be pulled. You can try advanced Configuration under group import mapping


Regards,
Rushikesh Vartak
If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'.

NM
Honored Contributor III
Honored Contributor III

@BarCar no it is not possible to exclude those.


If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'

BarCar
Regular Contributor
Regular Contributor

Yet another awesome product design. 🤡

NM
Honored Contributor III
Honored Contributor III

@BarCar create a idea tickets.. to be considered in future.


If this helped you move forward, click 'Kudos'. If it solved your query, select 'Accept As Solution'