Planning your next identity automation solution?

This article covers a legacy Tools4ever product. If you are evaluating NIM in the United States or Canada, start with the NIM guides for setup, integrations, and automation workflows.

Automatic unenrollment from SRRPM was released as a feature in version 6.73, build 1151 on August 1, 2016.

This feature allows for the automated 'clean-up' of enrolled users that no longer fall into an SSRPM Policy scope. This may be a result of no longer meeting specific group or container (OU) assignments or, optionally, accounts that have been disabled. This feature dramatically improves the license management process especially for organizations with a low or limited license count.

Enable the Job

Launch the SSRPM Management Console and select 'Service Management' from the toolbar. In the dropdown, select 'Configure'.  On the resultant options window, select the tab labeled 'Jobs' (in the ellipse below).

Option #1 - Checking this box allows for the SSRPM service to execute a background process that removes users from SSRPM enrollment when they fall outside of the group or container to which a policy is assigned.

Option #2 - Checking this box enables the background process to also remove users that have a UAC (userAccountControl) status of 'Disabled,' regardless of assigned policy

Further settings are entirely optional but are configured for the sake of caution. The 'fail-safe' setting prevents unintended unenrollments as a result of misconfigured policy or some manner of bulk activity affecting a large number of user accounts.

The 'Force Cleanup' button runs the background process immediately which is typically only necessary on the first configuration of the unenrollment task.

Additional Area of Improvement

One way to prevent unwanted enrollments is to leverage the OU 'blacklist.' Select 'Manage' then 'Profiles' from the toolbar in the SSRPM Management Console. The resulting window will show all available profiles. Select the button labeled 'Advanced' to bring up the OU exclusion list and select the 'Add' button to configure an exception:

The SSRPM implementation will now exist in a far more hands-off status than was previously available - resulting in a potentially far better user and administration experience.