Applies to All Version of DirectControl

Question:

How to clear user zone profile data automatically when deleting AD user in ADUC?

Answer:

By default, the zone profile data is stored in the scp object inside the zone container. You can register the administrative notification handler to ensure no orphan UNIX data is left in the directory if a user, group, or computer is deleted using Active Directory Users and Computers.

Notification handler can be installed in several ways:

1) During the installation of Centrify Admin Console it does prompt the following:

Select Register administrative notification handler for Microsoft Active Directory Users and Computers snap-in if you want to automatically maintain the integrity of the data stored in Centrify UNIX profiles, then click Next

If the checkbox for the above is not selected then the notification “Are you sure you want to delete this object? The selected object has other associated objects. Select those associated objects that you also want to delete. Centrify DirectControl Data” will not be presented.

2) After installation, on the machine Centrify Admin Console is installed you can do the following:

Open Centrify DirectControl Admin console -> Right click on "Centrify DirectControl" and choose “Setup Wizard” -> Follow the wizard and when you get “Register administrative notification handler for Microsoft Active Directory Users and Computers snap-in” select the checkbox.

Note: Registering the administrative notification handler requires Enterprise Admin or Domain Admin rights for the forest root domain.

This is part of the initial installation of Console on page 51 of the AdminGuide.

3) If you prefer doing the manual way which is using adsiedit:

Please refer to "Registering the administrative notification handler" Pg 70 of Deployment Manager Guide:
http://www.centrify.com/downloads/products/documentation/suite2011/ga/centrify-dc-deployment-guide.pdf