Users are getting removed from or added to groups or getting disabled for no apparent reason, after setting up Intrust and/or the Reporting Console to generate reports.
This can happen when an 'Action Parameter' filter has been set on a report or reports. One example of this is the "Group Membership Management" report which can remove added members, add removed members or disable the operator (person who did the change).
To confirm that this is happening, go to the "C:\Documents and Settings\userid\Local Settings\Application Data\Quest Software\Reporting Console folder and open the consolelog.txt" file. Look for something similar to the following at the time the change occurred. The important part is the 'adsnt.dll' entry.
04-21-2006 10:34:16 - 0x0 - (4048) - Loaded(D) : 0x72b30000-0x72b76fff adsnt.dll (C:\WINDOWS\system32\adsnt.dll) v 5.2.3790.1830 5.2.3790.1830
Once the line is found, search upward for (4048) {substituting the number found in the entry} until a similar line to the following is found.
04-21-2006 10:23:39 - 0x0 - (4048) - Executing report: Group membership management
This should indicate which report was executed to remove these users. Ensure to uncheck any 'Action Parameters' for this report under the filters option to prevent this from happening again.
Affects all versions of Intrust, except Intrust for Events or Intrust Express.
