Active Directory user name change

(0) Share

Report

Posted on by Community Member

Hi all,

where I work, if an employee is replaced by a new joiner, we give the new joiner the same active directory account, after changing the user name to match the new joiner name.

Recently, we have Dynamics AX in the picture, and when this happens, the transaction of the new joiner appears in the name of the old one in AX.

Example

Jim Approved an AX Purchase order (PO01) in January.

Jim left in February.

Alex joined to replace Jim in March, and took Jim active directory account.

Alex approved an AX Purchase order (PO02) in April.

If we check PO02 history, we find it is approved by Jim in April.

What is the the solution for this case?

Thank you!

*This post is locked for comments

I have the same question (0)

All responses (9)

Answers (1)

Sort by

Martin Dráb 239,093 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

The result is completely expected; it's what you should expect in every system if you keep the same account and merely change its properties.

But if you want, you can keep the same AD account and create a new user in AX.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report
Copy link

Link copied!

Thanks Martin, but how will creating a new user with the same AD help?

Was this reply helpful? Yes No
Martin Dráb 239,093 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Purchase orders have reference to AX user ID, not to AD SID. If you create a new user in AX (with a new ID), it won't be related in any way to transactions of the other user.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report
Copy link

Link copied!

Thank you, let me test this

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report
Copy link

Link copied!

I believe it will not work, since once I create a new user, it gives me error

Duplicate alias and network domain for the user.

Was this reply helpful? Yes No
Verified answer

nmaenpaa 101,166 Moderator on at

Like (0)

Report
Copy link

Link copied!

You must delete the old user first. You can't have multiple AX users for one AD account.

But why on earth do you have this kind of process for new employees? In my opinion the Active Directory account should be the unique identifier for each employee. It can be used to audit things that have been done in the past, and from any history and logs we always know who did what. As you know, this history is broken if you don't have separate AD user accounts for each employee.

My suggestion is to create a new user account for new employees.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report
Copy link

Link copied!

This is exactly what I also believe

Was this reply helpful? Yes No
Suggested answer

guk1964 10,888 on at

Like (0)

Report
Copy link

Link copied!

Its generally better to disable than to delete both in Ax, )or you may get table relation issues in field where user id has been used e.g. 'Created by' and in AD as mentioned for reasons of audit.

The problem is that you don't want to have to reconfigure all of your workflows for a new approver user, and there will also be open workflows in process. the simple workaround is to use User Groups , you can add and delete users to and from the group. You can also have just one user in a group if need be, and as needed change the user within the group. So when you get to a change, add the new user to the group and then delete the old one form the group, then disable the old user.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report
Copy link

Link copied!

the issue isn't only the WF, it is the tractability of who did what all around the system. once the AD Account name change, AX correspondent user record will not accept any update or delete.

Was this reply helpful? Yes No