What is best practice to manage inactive users

(0) Share

Report

Posted on by SteveWhyte

583

I have Dynamics AX 2012 integrated with active directory. Users are first added to AD and then imported into AX. Over the years many users have left the company and their domain access accounts disabled. My AX however has a massive amount of users in the Users Table.

Can anyone advise what is the best practice (in AD and AX) in handling dormant accounts?

Steve

*This post is locked for comments

I have the same question (0)

All responses (10)

Answers (0)

Sohaib Cheema 49,438 User Group Leader on at

Like (0)

Report

It’s a complex one. You don’t want to delete history of user’s activity for audit reason for certain years. This may keep you stay there with following two measure

1) Disable them from AD

2) Disable them from AX as well (Not delete)

If you think audit is not a factor in your country, you can delete those.

Was this reply helpful? Yes No
SteveWhyte 583 on at

Like (0)

Report

Thanks for your response.

Does AX allow you to delete users that posted prior transactions?

Was this reply helpful? Yes No
Suggested answer

BorisD 2,826 Moderator on at

Like (1)

Report

Hello Steve,

The best practice is to make sure the users is disabled in AD and in AX as soon as they are terminated. That being said there is no reason why you cant delete the user as well. It is depending on your Audit policy. Deleting the user doesn't delete the transactions history they have in the system. If the users has Batch jobs created that are scheduled to run on a schedule, you will need to recreate the batches under an active user account. Also, If the user is specified by name in any workflow, the workflow will need to be adjusted to reflect and active user. I have included a link that describes the process that should be followed to remove a user to maintain security in your environment. Hope this helps.

docs.microsoft.com/.../aa548648%28v%3dax.50%29

Was this reply helpful? Yes No
BorisD 2,826 Moderator on at

Like (0)

Report

Hi Steve,

As long as you have admin access to all the domains that the user is in. You will be allowed to delete the account. Even if the user has prior transactions in AX.

Was this reply helpful? Yes No
SteveWhyte 583 on at

Like (1)

Report

Thanks you very much for the info Boris and Sohaib

Was this reply helpful? Yes No
BorisD 2,826 Moderator on at

Like (0)

Report

Anytime Steve!

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hello Boris; In that link you sent it say that is better to delete the users, to avoid undesired access. But if a user is disable in AD and Disable in AX, is it possible to get access through a web application or other? Thank you !

Was this reply helpful? Yes No
BorisD 2,826 Moderator on at

Like (1)

Report

No, Once the user is disabled in AD and AX there is no way they are getting access. Unless they know someone else's password that still has access :)

Was this reply helpful? Yes No
Suggested answer

Community Member on at

Like (1)

Report

Thank you Boris!

Was this reply helpful? Yes No
BorisD 2,826 Moderator on at

Like (0)

Report

Any time!

Was this reply helpful? Yes No