EDR: User Removed From SSO but Still Present in Teams
search cancel

EDR: User Removed From SSO but Still Present in Teams

book

Article ID: 284938

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • User is removed from SSO but the user can still be seen in Teams but cannot be removed.

Environment

  • EDR On-Premise: All Supported Versions
  • EDR Cloud: All Supported Versions

Cause

  • Leftover items in Postgres that weren't removed during the users initial removal.

Resolution

  • Verify if that user is still present in the cb_user table:
psql cb -p 5002 -c "select * from cb_user;"
  • If still present, removal should go as follows:
psql cb -p 5002 -c "DELETE FROM cb_user WHERE id in (<deleted_user's_id>);"
  • It may also be required to remove the user from the user_role table, if the foreign key constraint will not allow the deletion above.
    • If any issues are encountered or anything is unclear, please contact VMWare Carbon Black Support, since tampering with the DB can have unintended consequences if mistakes are made.
  • If this is for a cloud instance, please contact VMWare Carbon Black Support.