AD synchronization - useraccountcontrol

0

Hi Essi,

I'm not aware of any such setting and I had the same problem in the past. The property didn't exist/ wasn't set for some accounts. At least it looked this way but in truth it turned out to be some permission problem which we didn't were able to resolve.

The only "solution" was that, for some reason, using an account of a Domain Administrator for the synchronization didn't caused the errors.

Here's a similar case:
https://serverfault.com/questions/788043/is-there-any-case-when-the-useraccountcontrol-attribute-is-blank


Best regards,
Daniel

Essi, AD property: useraccountcontrol is mandatory for WEBCON BPS AD synchronization (starting from version 2019 of WEBCON BPS).

Do not use Domain Admin account for synchronization (or any other services) this is not a good idea from security point of view.

The best way is to create dedicated domain account with full READ ONLY rights in Active Directory. (every AD has property Useraccuntcontrol - it contains info about user account status: enabled/disabled).

The article about mandatory properties will be updated ASAP.

Thank you very much for your help - our corporate policy does not let us use domain admin for these types of task anyway, so we'll verify accessing this value wit our corporate administrators (when I check in ADSIEdit, it shows a null value of this property which I believe, indicates some lack of authorization...?)

Hi Agnieszka,

yes, you are right. This property always has a value. If you don't see one, you don't have permissions. You could test, whether ADSIEdit is executed with Admin privileges, which could make a difference.

One remark regarding the Domain Administrator:
In our case, or better the responsible persons at the customer site, was not able to grant an account the required privileges. In addition, the property was retrieved for some users inside and not for others also they were in the same OU. Therefore we mentioned, that if he's not able to grant the privileges we could fall back on the Domain Administrator for the synchronization and that he would enter the password.


I cross my fingers, that you are able to resolve this. :)

Best regards,
Daniel

Thanks Daniel! After verificafion our admins found a group that had an authorization to read all properties and once my service ID was assigned that group, the sync ran successfully.