Identity Manager Account Template Assignment Verification - etautil Commands

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

After performing a "Synchronize User with Roles" operation in Symantec Identity Manager, it is necessary to verify that the Provisioning Server has correctly assigned the expected Account Templates to the Global Users. This can be validated using the etautil command-line utility.

Environment

Identity Manager 14.x & v15

Resolution

Using etautil to List Account Templates

The etautil.exe utility is located in the following directory by default:
[Identity_Manager_Install_Path]\Provisioning Server\bin

Option 1: Check a Specific Global User

To verify the eTSyncAccounts attribute for a single user, run the following command:

etautil -u [admin_user] -p [admin_password] report 'etGlobalUserContainerName=Global Users, eTNamespaceName=CommonObjects' eTGlobalUser globalusername=[Target_User_Name] list eTSyncAccounts

Option 2: Check All Global Users

To list Account Templates for all users in the "Global Users" container, use the select command with a wildcard:

etautil -u [admin_user] -p [admin_password] select 'etGlobalUserContainerName=Global Users, eTNamespaceName=CommonObjects' eTGlobalUser globalusername='*' list eTSyncAccounts

Additional Information

• eTSyncAccounts: This attribute contains the list of Account Templates currently synchronized with the Global User.
• If the list is empty, the synchronization task may have failed or the user does not meet the Role/Template membership criteria.
• Ensure you have administrative privileges on the Provisioning Server to execute these commands.