Synchronizing Initial Account Attributes with Active Directory Templates - CA Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article provides a procedure to synchronize account attributes that are marked as "Propagation Allowed" but are excluded from standard template synchronization due to IsPolicySync settings.

Certain account attributes, such as "Smart card is required for interactive logon" (eTADSuserAccountControl, bit 18), do not synchronize automatically during the Accounts/Template synchronization process. This occurs because the attribute is defined as "initial" rather than "capability," resulting in IsPolicySync: no within the parser table.

Environment

• Product: CA Identity Manager
• Releases: 14.x, 14.5, 15.x

Cause

While the attribute is "Propagation Allowed," it is excluded from the standard synchronization engine because it lacks the "capability" designation in the parser table (IsPolicySync: no).

Resolution

To propagate changes in the template for this attribute, use the following etautil script.

1. Prepare the environment: Ensure your ETAHOME, DOMAIN, USER, PASSWD, and TEMPLATE variables are set correctly in the script below.
2. Run the remediation script: This script selects the policy, reads the current attribute value, and pushes the update to all accounts associated with that policy.

@ECHO ON
set ETAHOME="C:\Program Files (x86)\CA\Identity Manager\Provisioning Server"
rem Provisioning Domain Name
set DOMAIN=
rem Provisioning Server administrator
set USER=
rem Provisioning Server administrator password
set PASSWD=
set TEMPLATE=

%ETAHOME%\bin\etautil -d %DOMAIN% -u %USER% -p %PASSWD% select 'eTADSPolicyContainerName=Active Directory Policies, eTNamespaceName=CommonObjects' eTADSPolicy eTADSPolicyName=%TEMPLATE% >TemplateAttributes.txt 

IF %ERRORLEVEL% NEQ 0 GOTO:EOF

:: Loop reading TemplateAttributes.txt file
set ORIVAL=null
FOR /F "tokens=1,2,3 delims= " %%A IN (TemplateAttributes.txt) DO IF "%%A"=="eTADSuserAccountControl" set ORIVAL=%%C
echo %ORIVAL%

IF %ORIVAL% == null GOTO:EOF

%ETAHOME%\bin\etautil -d %DOMAIN% -u %USER% -p %PASSWD% update 'eTADSPolicyContainerName=Active Directory Policies, eTNamespaceName=CommonObjects' eTADSPolicy eTADSPolicyName=%TEMPLATE% to eTSyncAccounts=1 eTADSuserAccountControl=%ORIVAL%

del TemplateAttributes.txt

 

Additional Information

• To verify attribute settings, you can dump the parser table using: dumpptt -f -t adsparse -of adsparse.txt.
• Ensure the script is executed by a user with sufficient Provisioning Server administrative privileges.