Return
-
Title
Migrated security group is being populated with already migrated but disabled users, even though domain pair is set to skip on disabled users. Disabled user is still a member of the group in the source domain. -
Description
What happens is the following situation:- user and group were migrated and user became a member of the group in target domain properly- source user was disabled- target user was removed from the target group- dirsync/linkresolver is re-populating target group with target user again even though the domain pair is set to skip on disabled objects -
Resolution
Such behavior is by design because group itself is not a disabled object in the source domain. Yet, there's an unresolved link to migrated object in the source (user or group). LinkResolver will act on such link, find that link is corresponding to another migrated object in the ADLDS database and populated the target group accordingly.
To resolve the issue, it's not enough to disable the source user. Source user should be removed from the source group.
-
Defect ID
NBDR4