We have multiple Active Directory connections due to differing account naming rules. This was initially set up by Saviynt Professional Services.
For one set of our endpoints we are applying an OBJECTFILTER like this:
(&(objectCategory=person)(objectClass=user)(sAMAccountName=*)(!(company-SharedServices-EmployeeID=*))(!(company-SharedServices-EmployeeType=Admin*
))((EmployeeNumber=*)))
Our STATUS_THRESHOLD_CONFIG is set as follows:
{
"statusAndThresholdConfig":{
"statusColumn":"customproperty24",
"accountThresholdValue": 20000,
"activeStatus":[
"512",
"544",
"2080",
"66048",
"640",
"4194816",
"66080",
"524800",
"590336"
],
"deleteLinks": false,
"correlateInactiveAccounts": true,
"inactivateAccountsNotInFile": false
}
}
When we execute a full account import we see Saviynt report success and updates 5,357 accounts. But we see many accounts in the endpoint which should be excluded by the OBJECTFILTER - they are being updated from AD because we can see properties changing in Saviynt when the import runs.
When executing the exact same LDAP filter in PowerShell we get only 2,332 users (3k fewer):
get-aduser -server global.tektronix.net -LDAPFilter "(&(objectCategory=person)(objectClass=user)(sAMAccountName=*)(!(company-SharedServices-EmployeeID=*))(!(company-SharedServices-EmployeeType=Admin*))((EmployeeNumber=*)))" | Measure-Object | select -expandproperty count
2332
I would expect any accounts not matching the OBJECTFILTER to be marked as suspended but this is not happening. We have bumped up the threshold to 20,000 but that has had no effect.
Can anybody see what we are missing to drop these non-matching accounts from this endpoint?
