Microsoft Active Directory (AD) users can be disabled by Administrators. The active state is tracked using one bit in the value of the attribute userAccountControl. The whenChanged attribute in AD is updated with the timestamp of the last time the object is updated.
This procedure describes how to configure the user management parameters for Microsoft Active Directory.
Run the Avaya Aura® Device Services configuration utility using the app configure command.
The active users search filter string contains the following elements:
objectClass: because the object needs to be of the user object class as this is the object class that AD uses to store AD user data.
objectCategory: because AD also uses the user object class for objects other than AD users. Notably, the Computer object is also of user object class. Adding this condition ensures that the object found is an AD user object.
userAccountControl:
The string 1.2.840.113556.1.4.803 specifies a bitwise AND filter to check the second lowest bit in the value of userAccountControl, which is 1 if the user is disabled. Negating this filter using the ! operator results in filtering for users that are NOT disabled.
