Hi all,
I used this code
to periodically delete all users from the Windows Login table that had been deleted in Active Directory. If they are deleted, their record in Windows Login changes the ID from domain\username to the SID.
It worked fine during tests. But when rolled out to our databases in some cases users where deleted that where still valid Active Directory users. And as long as the code ran, those users would be deleted, no matter how often they have been put back in the Windows Login table. Other users where not affected at all.
I had the suspicion that only those users where affected who had been deleted (not deactivated) from AD when they left the company and where created again with the same username (but different SID) when they joined us again later, but I couldn't reproduce that.
What makes it even more weird is that the same user was deleted from some, but not all databases although the delete job ran everywhere. There seems to be no pattern.
Can someone make sense of this?
I used this code
IF WinLogin.FINDSET(TRUE,FALSE) THEN BEGIN
REPEAT
WinLogin.CALCFIELDS(ID);
IF WinLogin.SID = WinLogin.ID THEN
WinLogin.DELETE(TRUE);
UNTIL WinLogin.NEXT = 0;
END;
to periodically delete all users from the Windows Login table that had been deleted in Active Directory. If they are deleted, their record in Windows Login changes the ID from domain\username to the SID.
It worked fine during tests. But when rolled out to our databases in some cases users where deleted that where still valid Active Directory users. And as long as the code ran, those users would be deleted, no matter how often they have been put back in the Windows Login table. Other users where not affected at all.
I had the suspicion that only those users where affected who had been deleted (not deactivated) from AD when they left the company and where created again with the same username (but different SID) when they joined us again later, but I couldn't reproduce that.
What makes it even more weird is that the same user was deleted from some, but not all databases although the delete job ran everywhere. There seems to be no pattern.
Can someone make sense of this?