Windchill Deleted / Deactivated User Process

Joe, really good questions.  We're very hesitant to go to 11.1 for this type of thing - collecting all related info and trying hard to plan for it.

We're still manually creating user accounts but using network passwords.  Monthly, we see who has not logged in for at least 45 days and move them to a Site level DeactivatedUsers group that WINDU picks up and recognizes and not active, then remove from all other groups, etc.  There is a related property that has to have that group name exactly.

Please share what you learn on this and ideally any procedure that you develop for handling.

We have the exact same setup as you. Every week we check for disconnected participants. If it has been more than 60 days since the user last logged onto active directory (easily accessible info using a "net user" command), then we remove them from Windchill. We use the 60 day threshold to avoid accidentally deleting someone who may just be out, if the AD account is marked Inactive it marks the Windchill user as disconnected.

The removal process involves handling any workflow tasks they have (tasks are re-assigned to responsible people in the contexts where they exist), cleaning up any workspaces and checked out objects they have, then deleting the user from Windchill. They are then removed from all role memberships, deleting the user automatically removes them from all groups but not all roles.

I am curious why you wouldn't want to delete the user if they have left your organisation? Deleted users are unable to receive new workflow tasks, don't show up in any groups and are nicely marked as deleted in the user interface. There is also a command line utility to "undelete" a user, so worst case you can get them back if you ever need to.

We also have the same configuration here where Windchill is fully integrated with Active Directory.  Let me copy @JHall's format and also try to answer each of your questions.

If you don't delete Windchill Disconnected users, what do you do with them?

The main problem with disconnected users is that they become 'invisible' to Windchill.  While a user is disconnected you can't find them in any of the normal participant lists.  This means you can't locate objects (CAD files, promotion requests, etc.) based on their user name.  For 'view only' users, having them disconnected and unsearchable isn't a big deal, but for content creators you will want to either reconnect them to a different account or delete them from Windchill.

We think that we would need to create a new Windchill DS user that we would reconnect them to.

This is more of a preference thing.  Do you want to allow users to be actually deleted from Windchill or just look like they're deleted?  If you intend to actually delete them, then there is no need for a dummy account to connect them to.  If you prefer to never delete anyone, then yes, you will need a different account to connect them to - either in Active Directory or in Windchill DS.

We would also remove them from all groups which is good enough for us as we don't put individuals into profiles.

Same here.  We generally use profiles to define permissions and then add groups to those profiles at the product/library level.

How has your process worked for you?

Works good.  Because certain Active Directory groups (that Windchill can see) have been added to corresponding Windchill groups, I don't have to manually assign permissions in Windchill every time I.T. creates a new user account.  As long as I.T. puts people into the correct groups in Active Directory, they are automatically given the correct permissions in Windchill.  Yes, I.T. still makes sure they let me know when a new user is being added (for license compliance reasons), but it really simplifies the process of adding new people to the system.

How is your process different?

Possibly closer communication with I.T. and H.R., especially when it comes to people who are returning to the organization.  As soon as an account is visible to Windchill, Windchill will immediately create a new user account for the corresponding AD account and then there will be two separate, unrelated accounts with the same name - one that says 'Deleted' and one that doesn't.  To prevent this I make sure I.T. notifies me BEFORE someone is re-added to Active Directory who existed previously.  This gives me a chance to undelete their Windchill account (cause it to become disconnected again) so when the AD account reappears it has something to snap to.

What challenges do you have with that process?

Again, if I.T. forgets to tell me about users getting getting re-added, I end up with double accounts in the system.  Yes, it is possible to delete them from the database, but it's a real pain.

Windchill 11.1

We have not made the jump to 11.1 yet.  Probably will wait until 11.2 drops in June.  At this point I don't expect any major changes to my approach.  I just have to make sure I'm aware of who is getting added to the system so I can maintain sufficient license counts.

One other thing to consider.  Certain processes in Windchill require an email address.  Giving more than one user the same email address will cause the upgrade/migration process to fail.  If a user is given an email address, it must be unique.