The ADSync schedule does not remove users' details for users that were deleted from Active Directory.
Active Directory Sync is not deleting users from Console under Organizational Views>Default>User.
It does correctly delete the users from the Console under Organizational Views>Active Directory Domains>[Active Directory Domain Name].
This happens in ITMS 8.5 RU3 and RU4
Release: 8.5 RU3 and RU4
Component: Active Directory Sync
There is a misunderstanding on how Users are removed in these locations:
The scenario mentioned above describes correct behavior, because:
a) this is not actually "deleting" in terms of the SMP, as only the OU membership is gone for the User, so it's not under "Active Directory Domains" organizational view
b) until the resource is entirely deleted - it will be visible under the Default organizational view structure, which is a "resource type view" for all resources.
c) actual resource deletion only happens after 7 days (default value), controlled by Core Setting: "ADResyncDeleteResourcesThresholdDays" :
0 - no threshold, delete immediately
N - days since last AD import, when this user was seen there
<customSetting key="ADResyncDeleteResourcesThresholdDays" type="local" value="7" />
Deletion will only happen, if the User resource does not have any inventory changes during this threshold, i.e. if some inventory class data (check is done by ResourceUpdateSummary table) was changed - resource will not be actually deleted. This check is only applied if the threshold value is greater than 0.
Put attention to the NS logs. Sometimes we can make the assumption that the "Directory Synchronization", or even the actual "Users AD Import Rule" Schedule for those Users is turned on when it is not. (KB 193879 "ITMS 8.0 HF1 - What has changed in the Symantec Management Console, on the Microsoft Active Directory Import page?")
If you see an entry like this in the NS logs when running "Directory Synchronization" (AD Sync) :
"No directory import rules are scheduled, resync will not perform any actions.","
usually indicates that the AD Import Rule has a disabled schedule, please check it.
ps. We've seen some times schedules were "off" after upgrades, so turn them "ON"