Unity accounts going away on their own

[Erick Bergquist]

We have a Unity 4.2(1) setup and over the past 3 or 4 days, 5 users voice mail accounts have gone away on their own.

The exchange mailbox and AD account are still there and no changes have been made to the system.

No errors in event logs (system, application, etc) indicating a problem and the Unity System report under SaWeb for admin access has nothing in the report at all for the past 10 days. They recreated the VM accounts and they are there but we need to find out why they went away or find a log, etc someplace showing what happened.

Should the reports in SaWeb for System , and Administrator have entries for when an admin creates an account, deletes an account, etc? They used SaWeb to create the accounts but nothing is in the report which is odd.

Unity 4.2(1.0) with ES 43, ES59 and TSP 8.2(1) ES4

Erick

[lindborg]

If nothing is showing up in the admin activity report about deleting users the most likely scenario is some other process outside of Unity is stripping off the Unity specific attributes in the directory (i.e. the ecsbulocationobjectID value and such) - if these values are being removed up stream then they will "fall" out of the Unity database when the directory synch happens.

The admin reports use the IIS logs - another possibility is those logs are being cleared out by another process - I'd run a test of a dummy user create and a user delete and ensure the logs are being added to properly (i.e. the info shows up in the admin activity report) - it could take up to 30 minutes for the data to show up in the report since the "scavenger" process that reads the data into the report DB can take up to that long to slurp it in.

[Erick Bergquist]

Thanks.

So, if I understand correctly, if the unity attributes on the AD account are being removed or tampered with then the Unity account will go away? A colleage of mine is seeing this issue at another client with 4.2(1) Unified as well.

Will check on the admin logs with your tip.

[Tommer Catlin]

I have seen people run scripts in AD that clean out AD accounts that either have not been logged into x amount days/months. These scripts will run and delete AD accounts, hence deleting the Unity subscriber account as well.

[Erick Bergquist]

But the AD account is still there, just the unity account goes bye bye completely.

In lindborgs post, he indicates that if the Unity attributes are removed or changed to something unity doesn't recognize , then it will remove the unity account on it's own? Does the process that does this log anything anywhere?