Community Tip - Learn all about the Community Ranking System, a fun gamification element of the PTC Community. X
Like many others, we authenticate Windchill users from Active Directory. When an employee leaves the company, our IT policy is to delete their account in AD. Unsurprisingly this causes several issues in Windchill.
Does anybody else follow this practice, and if so have you implemented a process or configuration change that ensures user information persists in Windchill after the AD account is deleted.
The obvious solution is to not delete the AD accounts of leavers, rather mark them inactive.
Without digging too deeply into technical details, I would be interested to hear some pros and cons of different strategies on this topic.
Thanks Darren
Darren,
We dont delete user account in AD, just mark it as inactive. On the Windchill side, we dont do anything and see username(deleted) marked everywhere instead of username. With his practice, we see only one issue in reporting Change Task details which we have reported to PTC Tech Support. They are planning to fix it in future releases. What issues you encountered?
Yogesh
Hi Yogesh
Some issues are:
Regards Darren
Darren,
we did encounter #4 which was taken care by modifying business process to re-assign task(s) before putting in removal request. Rest we did not encounter.
Yogesh
It is commonly that most Windchill Admins don't control enterprise AD forest. I suggest if the user becomes a disconnected principal is to:
Its like the reverse process of changing Ldap user to AD, you can delete the user in Windchill DS, then the user will become disconnected, edit the disconnected participant to point to the AD user.
If you have a chance to work with your enterprise AD administrator, just change the password and move the user to branch/org ofdiscontinued/non-companychange the password and email toWindchill administrators control.Hopefully, they don't delete users in enterprise AD.
Hopefully that helps,
Patrick
I forgot a couple more things:
To continue with Yogesh with reassigning and resetting assigments. Change the user's calenders for running process (non-executed task) and future task to be assigned to a different user.
this way no-watermarks or previous released drawing/documents title blocks will not be affected if the user has left the company. (i.e.PTC_created_by or PTC_modified_by)
Hope that helps,
Patrick
In Reply to Patrick Chin:
It is commonly that most Windchill Admins don't control enterprise AD forest. I suggest if the user becomes a disconnected principal is to:
- Go to Participant Administration
- Create a new Windchill userwith the same userid but differnt email and password (admin) like Mike Foster mentioned but only in company.domain.Ldap
- Search for disconnected principles which should appear as a list or individual if you know the AD userid
- edit the disconnected participants to point to the new Ldap user.
Its like the reverse process of changing Ldap user to AD, you can delete the user in Windchill DS, then the user will become disconnected, edit the disconnected participant to point to the AD user.
If you have a chance to work with your enterprise AD administrator, just change the password and move the user to branch/org ofdiscontinued/non-companychange the password and email toWindchill administrators control.Hopefully, they don't delete users in enterprise AD.
Hopefully that helps,
Patrick
In Reply to Patrick Chin:
It is commonly that most Windchill Admins don't control enterprise AD forest. I suggest if the user becomes a disconnected principal is to:
- Go to Participant Administration
- Create a new Windchill userwith the same userid but differnt email and password (admin) like Mike Foster mentioned but only in company.domain.Ldap
- Search for disconnected principles which should appear as a list or individual if you know the AD userid
- edit the disconnected participants to point to the new Ldap user.
Its like the reverse process of changing Ldap user to AD, you can delete the user in Windchill DS, then the user will become disconnected, edit the disconnected participant to point to the AD user.
If you have a chance to work with your enterprise AD administrator, just change the password and move the user to branch/org ofdiscontinued/non-companychange the password and email toWindchill administrators control.Hopefully, they don't delete users in enterprise AD.
Hopefully that helps,
Patrick
Patrick,
Hi, I am a colleague of Darren who submitted this topic, thanks for your input.
A query about your suggested method of moving an Enterprise LDAP user to Administrative LDAP, if I may?
If I have understood your method correctly, don't you end up with two entries in the Windchill WTUSER table both pointing at the new user Account in Administrative LDAP - and is this a problem or not?
My reasoning:
Hi Gary,
There is no purging disconnected principles/participants because what you have done is repair the disconnected principle WTUserID to point to another. Thus, the user is not deleted from Windchill but is no longer used. Since you have actual past released metadata that is linked to drawings, attributes and even watermarks that is instantly updated on a change in Windchill, it is best not to change the value of released artifacts.
It is similar to switching users from WindchillDS to the enterprise AD. The method of reparing disconnected participants prevents any lost of data in users workspaces because they are now controled and cleanned up by the Windchilll Administrators. The new passwords of the user accounts can be given to their reporting manager to be accessed and checked-in by their backup users.
Then when all their work is checked-in, just reset the password and no one can access Windchill with their accounts.
No purging of the Windchill user.
Thanks,
Patrick
In Reply to Gary Mansell:
Patrick,
Hi, I am a colleague of Darren who submitted this topic, thanks for your input.
A query about your suggested method of moving an Enterprise LDAP user to Administrative LDAP, if I may?
If I have understood your method correctly, don't you end up with two entries in the Windchill WTUSER table both pointing at the new user Account in Administrative LDAP - and is this a problem or not?
My reasoning:
- Best Regards
I found on our system 10.1 M040 the procedure was a little different. I was not able to Edit disconnected participant.
User was deleted from Enterprise AD and disconected in Windchill.
1. Create New User in ORG on directory service com.<company>.Ldap
3. Search for Disconnected User
4. "Reconnect Disconnected Participant" on user to new user (-DS)
5. Cleanup
Cheers!
Ok I have this working now, looks like I was making a silly mistake somewhere along the line.
Darren
Stephen
Lets assume the user returns to employment and uses the same UID as before.
You are very welcome guys. It is hard to keep up with the changing of the UIs of Windchill but the core process remains the same.
With the question if the person returns, just do the reverse by:
Sounds good.
Patrick
In Reply to Vaughn McDaniel:
Thanks Darren
Yeah, I was not using the WDS console, my procedure was using the Windchill ORG Participant Administrator.
Vaughn