Symantec VIP - How to automate removal of inactive users from VIP Manager

Products

• VIP Service

Issue/Introduction

There may be situations whereby inactive users need to be removed from VIP Manager without going through an LDAP Synchronization

Environment

VIP Manager

Resolution

The VIP Manager’s 'Automatically Delete Users' policy (Policies tab > Account tab > Users section) can delete users that have not been active in the configured time range.

For user deletion to take place, the following criteria must be met:

• No credentials or devices are bound to the user, and
• There has been no user activity for the specified number of days (from 15 to 730)

     VIP deletes all users that meet these criteria daily during the last data refresh (typically around 11:59:59 pm UTC).
     This operation cannot be undone.

In conjunction with the Automatic Delete User policy, the Credential Expiration policy (Policies tab > Account tab > Credentials section) can be used to dissociate credentials from their respective users. An expired credential will become inactive and will be removed from the user. This action satisfies one of the two criteria listed above. And after the second criteria is met, the Automatic Delete User policy takes effect with which the users will then be deleted.

One can see the activity for this policy in the VIP Manager Audit logs: