Active Administrator 8.7 - User Guide

Reporting on inactive accounts

Reporting on inactive accounts

You can choose to create a report to display in a report editor, to send in an email, or to save to a file.

NOTE: The email server must be configured to send notifications. See Setting email server options.

To send an inactive report by email or save to a file

1	Select Security & Delegation | Inactive Accounts.

2	Click Reports.

3	Select Delivery report, if necessary.

4	Change the default report name if desired.

5	By default, the date and time are appended to the end of the file name. Clear the check box if you do not want the date and time appended to the file name.

6	By default, a PDF file is created. You can choose a different format.

7	You can send the report by email and save it to a file.

To send an email

a	Click Email, if necessary.

b	By default, the logged in account displays in the Email Addresses list. To add more recipients, click Add, type the email addresses, and click OK.

c	Modify the default subject line if desired.

d	Set the priority of the email.

To save the file to a folder

a	Click Save to Folder.

b	Click Add.

c	Add a path to the location where you want to store the report file.

d

Click OK.

8

Click OK.

To generate an inactive accounts report and display in a report editor

1	Select Security & Delegation | Inactive Accounts.

2	Click Reports.

3	Select Interactive.

4

Click OK.

Purging stale accounts

Purging stale accounts

By default, inactive accounts are purged after 30 days of inactivity. You can set up a schedule, send notifications, and prevent specific users from being deleted.

To set up stale account purging

1	Select Security & Delegation | Inactive Accounts.

2	Click Set up next to Purge stale users or Purge stale computers.

3	Set the schedule for Active Administrator to check for stale accounts.

4	Set the number of days after which an inactive account is purged. The default is 30 days.

5	Select to send notifications. You can send a notice when the account is about to deleted and/or when the account is deleted.

6	To prevent specific accounts from being deleted, click Add, select the account, and click OK.

7	Click Save.

Sending password reminders

Sending password reminders

If enabled, the Password Change Reminder service runs every day at the time you specify. If user accounts are about to expire, email notifications are sent to the users according to the schedule you set up. You can set up to three levels of password reminder notifications. For example, you could set up the first reminder at 14 days, the second at 7 days, and the final notification at 1 day before the password expires. You can then choose to repeat the final notification until the user changes their password. You can also send the manager a notification when a user is sent a password reminder.

To help manage the email password reminder notifications, in addition to the custom schedule, you can create a custom email list of select user accounts. When previewing the list of user accounts about to expire, you can select only the accounts you want to receive the email password reminder notification. You can send a notification on demand, or let your custom schedule handle the delivery.

Daily, the email addresses you specify receive the administrator summary notification, which is a list of users with expired passwords and users with passwords about to expire. You can choose to exclude accounts with less than or more than a configurable number of days before their password expires. You can also exclude organization units, users and groups, accounts that start or end with specific criteria, and enabled or disabled accounts. The administrator summary notification indicates if the user was notified.

 

NOTE: The email server must be configured to send notifications. See Setting email server options.

To send password reminders

1	Select Security & Delegation | Password Reminder.

2	Click General, if necessary.

3	By default, the password reminder feature is enabled. To disable the feature, clear the check box.

4	Select a time for Active Administrator to run the Password Change Reminder service.

NOTE: You can run the Password Change Reminder service at any time by clicking Run Now.

5	Set the number of days prior to a password expiring that signals Active Administrator to begin sending email password reminder notifications. The maximum value is 90 days.

6	Select to send additional levels of notification, if desired.

7	Select to repeat the notifications after the final notification, if desired. Once the password expires, the user will receive a notification daily until the password is changed.

8	By default, accounts with expired passwords are included in the administrator password summary notification. To exclude accounts with expired passwords, clear the check box.

9	Optionally, set Send manager notifications to notify the manager when a user receives a password reminder.

NOTE: The user must be linked to a manager in Active Directory.

10	Choose to sort the results by User Name, Expiration Date, Domain, or nested by Domain/Expiration Date/User Name or by Domain/User Name/Expiration Date.

11	By default, the email address of the Active Administrator owner that was added during installation automatically receives the administrator password summary notification. To add additional email recipients, click Add.

 

NOTE: The Active Administrator owner was identified in the AA Configuration Wizard. To change the AA Owner email address, see Managing email addresses. NOTE: To manage the Password Reminder Settings email address list, see Managing email addresses.

12	Choose the domains to monitor for password expiration.

a	Click Domains.

b	To add additional domains, click Add, select a domain, and click OK.

13	Optionally, configure exclusions.

a	Click Exclusions.

b	To add exclusions, click Add, set the Password Reminder Filters, and click OK to save the settings.

Table 25. Password Reminder Filters

Filter	Usage
Apply to Domain	Set a domain to which the filters will be applied.
Exclude Organization Unit	Add organization units to be excluded.
Exclude Users and Groups	Add users and groups to be excluded.
Starts with <condition>	Type a “starts with” condition that will be used to exclude user or computer objects.
Ends with <condition>	Type an “ends with” condition that will be used to exclude user or computer objects.
Exclude user accounts with less than X days before their password expires	Type the number of days to consider. Any accounts with less than this many days before the pass word expires will be excluded.
Exclude user accounts with more than X days before their password expires	Type the number of days to consider. Any accounts with more than this many days before the password expires will be excluded.
Exclude user if account is enabled or disabled	Set whether a user account is excluded when it is enabled or disabled.

c	Optionally, click Edit to change a selected exclusion.

d	Optionally, click Remove to remove a selected exclusion.

14	Customize the message to send. A default message is provided, but you can edit parts of the message to fit your needs.

a	Click Message.

A default message is included. To view the default message, click Preview Message.

b	To change the default Subject Line or Manager Subject Line of the email notification, click in the box and edit the default text.

There are variables you can use to customize the subject line or the body of the message.

 

Table 26. Variables to customize subject line or body of password reminder message

Variable	Description
%FIRSTNAME%	First name of the user
%LASTNAME%	Last name of the user
%DISPLAYNAME%	Display name of the user
%DATE%	Expiration date
%LASTCHANGEDATE%	Date of last change to the password
%DAYSLEFT%	Number of days left before the password expires
%USERNAME%	Username of the user

c	Choose how to display the name of the recipient in the message greeting.

d

The email message has the following sections: Greeting, Message, Info, Instructions, Requirements, Helpful Advice, and Help Desk. The manager notification has the following sections: Message and Info. You can enable or disable a section, edit the default text, and add an image, such as a company logo.

▫	To disable a section, clear the check box.

▫	To change the text or include an image in the message:

-	Click Edit next to the section you want to change.

-	Make changes in the text editor that opens, optionally making use of the variables in Table 26.

-	Click Save.

▫	To restore the text to the default, click Default.

e	To preview the message, click Preview Message.

15	Preview the list of user accounts with passwords about to expire. You also can choose user accounts to receive notifications.

a	Click Preview and Notify.

b	Click Preview.

c	By default, the list of user accounts is based on the settings on the General tab. To override the settings on the General tab, select the check box, and enter the number of days before passwords expire.

d	By default, accounts with expired passwords do not display. To show accounts with expired passwords, select the check box.

e	To export the list of user accounts to a .csv or .txt file, click Export.

f	To create a custom email list, select the users to receive the email password reminder notification. You can filter the list of user accounts, and use Select All and Clear All to help with the selection.

g	To send the email password reminder notifications immediately to the selected user accounts, click Send Notification. Otherwise, the email password reminder notifications are sent according to the schedule you set up.

h	Click Yes to accept the confirmation message.

16	Click Save.

17	If you want to run the Password Reminder Service now, click Run Now. Otherwise, the task runs according to the schedule designated on the General tab.

Sending account expiration notifications

Sending account expiration notifications

You can manage account expirations by configuring an email message to send when user accounts are about to expire.

NOTE: The email server must be configured to send notifications. See Setting email server options.

To send account expiration notifications

1	Select Security & Delegation | Account Expiration.

2	Click General, if necessary.

3	By default, the account expiration notification feature is enabled. To disable the feature, clear the check box.

4	Select a time at which Active Administrator checks for accounts about to expire.

NOTE: You can check for expired accounts at any time by clicking Run Now.

5	Select the number of days prior to an account expiring that signals Active Administrator® to begin sending email notifications.

6	Select to send the notification to the user and/or the manager of the user.

NOTE: The user must be linked to the manager in Active Directory®.

7	By default, the administrator email address added during installation automatically receives the account expiration notification message. To add additional email recipients, click Add.

 

NOTE: The Active Administrator owner was identified in the AA Configuration Wizard. To change the AA Owner email address, see Managing email addresses. NOTE: To manage the Account Expiration email address list, see Managing email addresses.

8	Click Domains.

9	To add additional domains, click Add, select a domain, and click OK.

10	Click Message.

There are two messages: user and manager. Use the variables in the table below to construct your subject line and message.

 

Table 27. Account expiration message variables

Variable	Description
%username%	User name
%displayname%	Display name of the user
%date%	Date account is set to expire

11	To change the default subject line, click in the box and edit the default text.

12	To change the text in the message, click Edit, make changes in the text editor that opens, and click Save.

▪	To restore the text to the default, click Default.

13	Click Preview.

14	To preview the list of accounts about to expire, click Preview.

15	Click Save.

16	If you want to check for expired accounts now, click Run Now. Otherwise, the task runs at the time designated on the General tab.