Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-1939: How to clear user zone profile data automatically (using Notification Handler) when deleting AD user ?

Authentication Service ,  

12 April,16 at 10:57 AM

Applies to All Version of DirectControl


How to clear user zone profile data automatically when deleting AD user in ADUC?


By default, the zone profile data is stored in the scp object inside the zone container. You can register the administrative notification handler to ensure no orphan UNIX data is left in the directory if a user, group, or computer is deleted using Active Directory Users and Computers.

Notification handler can be installed in several ways:

1) During the installation of Centrify Admin Console it does prompt the following:

Select Register administrative notification handler for Microsoft Active Directory Users and Computers snap-in if you want to automatically maintain the integrity of the data stored in Centrify UNIX profiles, then click Next

If the checkbox for the above is not selected then the notification “Are you sure you want to delete this object? The selected object has other associated objects. Select those associated objects that you also want to delete. Centrify DirectControl Data” will not be presented.

2) After installation, on the machine Centrify Admin Console is installed you can do the following:

Open Centrify DirectControl Admin console -> Right click on "Centrify DirectControl" and choose “Setup Wizard” -> Follow the wizard and when you get “Register administrative notification handler for Microsoft Active Directory Users and Computers snap-in” select the checkbox.

Note: Registering the administrative notification handler requires Enterprise Admin or Domain Admin rights for the forest root domain.

This is part of the initial installation of Console on page 51 of the AdminGuide.

3) If you prefer doing the manual way which is using adsiedit:

Please refer to "Registering the administrative notification handler" Pg 70 of Deployment Manager Guide: