What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

re: What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

Rokas — Thu, 08 Dec 2011 15:25:49 GMT

Hello,

I'm wondering, if there are any possibility of recording/monitoring this change in SCSM CMDB:

record which new object(s) has been imported and which removed during connector synchronization?

Thanks in advance !

re: What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

Brent — Wed, 04 May 2011 19:23:24 GMT

Travis, thanks for the info, makes sense. However, I do see some wierd behavior in this scenario. My AD Connectors, changes the AD SID property of my CI every hour, then a minute later, changes it back. It is almost like the connector is confused about which SID is the active one in AD (even though the old one has been deleted). Have you seen this before? I see this for all my CIs that have deleted, decomissioned, and then rebuild later with the same server name. Thx!

re: What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

Travis Wright MSFT — Mon, 02 May 2011 17:07:15 GMT

@Brent -

The computer class uses the fully qualified domain name (aka Principal Name) of the computer as the computer's identity. If the computer is brought back with the exact same name then we assume it is the same computer. Please see this blog post for more information on the computer class and identity.

blogs.technet.com/.../understanding-the-computer-model-in-service-manager.aspx

re: What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

Travis Wright MSFT — Mon, 02 May 2011 17:05:04 GMT

@JR52MAR - I think what I would do in that case is just disable the AD connector instead of deleting it.

re: What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

Brent — Mon, 02 May 2011 15:23:28 GMT

Hey Travis, thanks for the great post, great info! I did have a question thou, how does the connector handle retiring/rebuilds with the same names? For instance, server "AD01" gets decomissioned and deleted from AD/SCCM, the connectors mark the Computer CI Pending Delete as expected from your post. A week later, the server "AD01" gets rebuilt with a new OS, same name. It appears the Connectors move the object back from the Deleted Items Container back to All Computers. Is that correct? The issue here is it makes it hard to track between iterations of the server (I don't know if I am looking at work done on the old AD01 or the new AD01). Is it possible to mark a Computer CI as retired and force the connectors to create a new CI; this way they will be tracked independently? We currently have to leave old Computer CI's in Deleted Items container "indefinetely" because we need tickets to keep their relationship to the CIs for a long time. What is the best practice for retiring CIs; knowing that a new system very likely may be rebuilt with that name again in the future on new or same hardware? Thanks!

re: What Happens to a User in the CMDB When it is Deleted in Active Directory (AD)?

JR52MAR — Sat, 30 Apr 2011 08:55:44 GMT

Hey travis is there a way that you can get all the users from active directory via the connector and then when they have all copied, remove the connector and then remove the flag for pending delete so that they will show up as though they had been manually created?