Remove From My Forums

Project Server 2016 AD Sync Resource Inactivation

Question
0

Sign in to vote

Hello,

I am wondering if anyone can give a clear answer on when the Project Server AD Sync will inactivate a user/resource. My previous understanding was that it would never inactivate a currently active resource, only reactivate an inactive resource if they were found in the AD Sync and the setting to reactivate was checked.

I have a situation currently where I have a user who is in multiple AD groups that are sync'd to PWA Security groups, but is not in the AD Group that is sync'd to the Enterprise Resource Pool and they are being inactivated every night during the AD Sync job (not sure if its the Security group job or the ERP job). However, my account is not in any of the AD groups and it remains active, there are several other accounts in various groups that also remain active, and several others in various other configurations that are getting inactivated. I don't seem to see a trend at this point, and something is obviously going wrong. But my first step in troubleshooting, what is the expected result? Does PWA ever inactivate resources? I know it used to a few versions back if they werent found in the ERP, but I didn't think it did that anymore.

Friday, June 22, 2018 4:21 PM

Reply

|

Quote

All replies

0

Sign in to vote

Hello,

Here are the secenarios for the different Ad syncs:

Security Group AD sync: https://docs.microsoft.com/en-us/project/manage-security-group-synchronization-with-active-directory-in-project-server#security-group-synchronization-scenarios

Enterprise Resource Pool AD sync: https://docs.microsoft.com/en-us/project/manage-active-directory-resource-pool-synchronization-in-project-server-2013#user-synchronization-scenarios

Nothing documented to inactivate users. I would maybe look to either repro this on a test PWA instance to start investigating or maybe temporarily disable the security group sync for a night and see if this user is still made inactive to work out which process is causing it.

Paul
Paul Mather | Twitter | http://pwmather.wordpress.com | CPS | MVP | Downloads

Sunday, June 24, 2018 12:59 PM

Reply

|

Quote

Moderator
0

Sign in to vote

Hey Paul,

We are trying to repro this in an internal environment but it is complex. Basically I am just at the point where I am trying to determine if there is an issue with our environment, a bug, or if it is working as designed. Unfortunately, I can't seem to determine how it is supposed to work because the documentation seems to conflict itself. I originally read the links you provided and that is where I had the same opinion, PWA wont inactivate only reactivate. But, then a colleague found this:

https://docs.microsoft.com/en-us/project/deactivate-user-accounts-in-project-server

"When you are using Active Directory synchronization, Project Web App users not found in the Active Directory group being synchronized will be deactivated."

The document says it applies to Project Server 2016, but I am wondering if maybe this document is old and wasn't updated fully? Since I know that in the past (2007?) there was a time where it did inactivate resources?

Monday, June 25, 2018 8:46 PM

Reply

|

Quote