-
제목
Handling of useraccountcontrol attribute flags -
설명
When the properties for a user account are opened to the Account tab, if the checkboxes are either selected or cleared in the Account options dialog box, numerical values are assigned to the UserAccountControl attribute. The value that is assigned to the attribute tells Windows which options have been enabled. As per best practices, documentation and Migration Manager Release Notes, it is not possible to skip the UserAccountControl attribute from synchronization. Enabled/disabled state of the user is not synchronized from source to target.
-
원인
During the synchronization and migration sessions the UserAccountControl attribute is handled differently from other attributes. The Directory Synchronization Agent will synchronize ALL useraccountcontrol flags except ACCOUNTDISABLE (0x0002)
-
해결 방안
This behavior is by design.
At all times during the migration project, the user is supposed to have access to either the source or target environment or in some cases to both. DSA will not synchronize the enabled or disabled state of the user.
During migration session it is possible to select the following options:
"disable source accounts" and "enable target accounts". If the option to enable target accounts is not selected, it is not possible to select the "disable source accounts" checkbox to prevent having both objects disabled. -
추가 정보
NOTE:
Useraccountcontrol attribute is handled by a component of Directory Synchronization agent that is called activation handler. Apart from enabling and disabling users, this component is also responsible for mailbox-enabling objects and setting the passwords and sidhistory. For example if a password has changed on the source user, an object goes through activation and its UserAccountControl attribute is synchronised to the target together with the password, even though no UserAccountControl flags were modified on the source user. This results in a situation where any changes on the target objects' UserAccountControl will be overwritten by source values frequently, since this attribute cannot be skipped from synchronisation.
More details on the specific UserAccountControl flags can be found in Microsoft KB:
http://support.microsoft.com/kb/305144