Managing Active Directory users

The Active Directory Connector retrieves Active Directory user information only from the organizational unit (OU) that was selected when the Active Directory Connector was installed. For more information about configuring the OU from which to retrieve Active Directory information, see the BlueCielo Kronodoc Administrator's Guide.

All user account management must be performed using the Active Directory management tools:

• User accounts can be created anywhere in the configured OU tree.
• User account changes (including password changes). Users can be safely moved within the configured OU tree. Kronodoc refers to them by globally unique IDs (GUIDs). A user's GUID never changes, even if the user is moved or other data is changed.

Note    User accounts that have been moved to a different OU in Active Directory appear in Kronodoc as globally unique IDs (GUIDs), not as recognizable user names.

Note    User information that has been changed in Active Directory might take up to 15 minutes to appear in Kronodoc.

• Users should not be deleted from Active Directory as this may leave unrelated data in Kronodoc. Instead, remove the user from all Active Directory groups to which the user belongs and clear the user account.

Tip    Create a folder in Active Directory specifically for cleared user accounts.

Note Kronodoc can be configured to store user information retrieved from Active Directory in Kronodoc and to use the data if a user is deleted in AD. This requires schema changes on the Kronodoc server in the file ntds_conf.pm.

Working with AD users in Kronodoc is described in the following topics.