Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -123,5 +123,3 @@ Ensure that:

> **IMPORTANT:**
> Rerun jobs that use the ExchangePS data collector to confirm that the error message no longer appears.

---
Original file line number Diff line number Diff line change
Expand Up @@ -53,5 +53,3 @@ This ensures the session uses the appropriate credentials, allowing the necessar
> Navigate to **Settings > Connection** to verify which credentials are valid for Exchange.

6. Click **OK** to save the changes.

---
Original file line number Diff line number Diff line change
Expand Up @@ -65,5 +65,3 @@ To resolve this warning, follow these steps:

4. **Retry the bulk import**
- Once scans have completed successfully and the DLPEX databases exist, rerun the SEEK Bulk Import.

---
18 changes: 8 additions & 10 deletions docs/kb/accessanalyzer/deleted-objects-in-adinventory.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,10 @@ IsDeleted column is not being populated in AD Inventory Users view
Objects are not being flagged as deleted by ADInventory.

## Instructions
ADInventory uses LDAP queries to enumerate objects from Active Directory.
ADInventory uses LDAP queries to enumerate objects from Active Directory.
A full scan will query all objects, updating the full data set each time.

The option to **Collect only updates since the last scan** only returns user, group and computer objects that have changed since the last scan.
The option to **Collect only updates since the last scan** only returns user, group and computer objects that have changed since the last scan.
This works by scoping the scan to objects having a `USNChanged` value greater than the highest value recorded for that domain controller at the start of the previous scan.

In order for the IsDeleted column to be updated properly, you must either have:
Expand All @@ -45,7 +45,7 @@ OR

- You must deselect the option to **Collect only updates since the last scan**.

If you go the route of granting the service account increased access, the Domain Admins group is not necessarily sufficient to gain proper access in all environments.
If you go the route of granting the service account increased access, the Domain Admins group is not necessarily sufficient to gain proper access in all environments.
The ACL on the all containers including the "delete objects" container should be checked to ensure that the service account has been granted the proper access.

To verify your account has access to the **Deleted Objects** Container, you are required to log on to a computer with **Active Directory Administrative Center (ADAC)**:
Expand All @@ -55,7 +55,7 @@ To verify your account has access to the **Deleted Objects** Container, you are
3. Select your domain for the environment you are running Active Directory Inventory.
4. On the right hand pane double click to open **Deleted Objects**.

This will list the deleted objects. If you are unable to view this with the connection profile account, you will need to ensure that the correct permissions have been assigned.
This will list the deleted objects. If you are unable to view this with the connection profile account, you will need to ensure that the correct permissions have been assigned.
By default the Builtin Administrators group has access to this container (`BUILTIN\Administrators`).

One method to grant a credential the necessary rights on the **Deleted Objects** container is using the `dsacls` command with an account that does have access to the container.
Expand All @@ -66,7 +66,7 @@ Schema admins may be required to execute this. See Dsacls Technet Article here:
dsacls "CN=Deleted Objects,DC=Contoso,DC=com" /G \:LCRP
```

This article shows how to modify the permissions on the deleted items container:
This article shows how to modify the permissions on the deleted items container:
https://technet.microsoft.com/en-us/library/cc816824(v=ws.10).aspx

So, if it helps at all, here's an article with some other information: https://technet.microsoft.com/en-us/library/dd379509(v=WS.10).aspx#BKMK_1
Expand All @@ -76,9 +76,7 @@ By default, builtin\administrator has access to this container. So, by default,
## Displaying the Deleted Objects container
When Active Directory objects are deleted, they are placed in the Deleted Objects container. By default, the `CN=Deleted Objects` container is not displayed. You can use the `Ldp.exe` administration tool in Active Directory Domain Services (AD DS) to display the Deleted Objects container.

---

**Product:** Netwrix Auditor
**Module:** SA - DC - ADInventory
**Versions:** all
**Product:** Netwrix Auditor
**Module:** SA - DC - ADInventory
**Versions:** all
**Legacy Article ID:** 1193
Loading