http://www.thycotic.com/forums/messages.aspx?TopicID=294 Thycotic Community - Secret Server - AD Sync Bug - Messages en-us http://blogs.law.harvard.edu/tech/rss Jitbit AspNetForum Thu, 26 Aug 2010 10:05:10 GMT Thu, 26 Aug 2010 10:05:10 GMT http://www.thycotic.com/forums/messages.aspx?TopicID=294
I will add disabling all users and groups when a Domain is disabled as a Feature Request. I think that action is the expected behavior but it should probably warn the user because then they will need to manually re-enable the Users if not using AD synchronization and only temporarily disabling the Domain.]]> Thu, 26 Aug 2010 10:05:10 GMT http://www.thycotic.com/forums/messages.aspx?TopicID=294
Steps to replicate

Sync SS with an AD domain security group. Add some accounts to the group and then sync the accounts.

After the accounts are enabled, then deactivate the domain through SS Ad Sync -> Edit domains.

Now, re-sync with AD. All the accounts in the disabled domain remain enabled.

Now, if the domain no longer exists, they can't actually log into SS, however for licensing purposes it would be nice to not have to manually disable multiple accounts in SS if the whole domain is set to the Disabled flag within SS.]]> Thu, 26 Aug 2010 09:05:00 GMT