AnsweredAssumed Answered

Account review - unable to filter out Disabled Accounts

Question asked by Shlomo Katz on Jun 1, 2020
Latest reply on Jun 2, 2020 by Shlomo Katz

Like • Show 0 Likes0
Comment • 10

7.2

Hello

I have an Account review that looks at an Active Directory group membership for the accounts to review.

We have accepted "disabled accounts" in this group that I do not want in this review.

When I use accounts."Is Disabled" = 0 in the account filter , it does not return any users.

I do have multiple "and" clauses, but since I have returns without the "Is Disabled" , I am wondering why this is not working or is there a better way.

I check PV_Users to confirm the data, should I be looking somewhere else?

Thank you

Shlomo Katz Jun 2, 2020 1:47 PM

Correct Answer

Thank you Ian Staines for confirming that "it should work".

I re-did the filter with the Simple UI versus the Advanced UI.

This "resolved" my issue.

Much appreciated.

See the reply in context

No one else had this question

Outcomes

10 Replies

Clive Morrish Jun 2, 2020 5:12 AM
Mark Correct
Correct Answer
Hi Shlomo,

You mention this is an Account Review but highlight the query does not return any users and that the also reference PV_Users. The mixture of account review but user based filtering may be causing the problem.

Are you able to share the full account filter query that you're using?

Thanks,
Clive
1 person found this helpful
Like • Show 0 Likes0
Actions
- Shlomo Katz @ Clive Morrish on Jun 2, 2020 8:43 AM
  Mark Correct
  Correct Answer
  Thank you for pointing that out, this was a oversight in my typing.
  This is the filter and it I looked at PV_Accounts
  All columns used are "accounts" and I am trying to use "accounts."Is Disabled"
  Like • Show 0 Likes0
  Actions
  - Ian Staines @ Shlomo Katz on Jun 2, 2020 11:40 AM
    Mark Correct
    Correct Answer
    And this is an "Account Access and Ownership" review?
    Like • Show 0 Likes0
    Actions
    - Shlomo Katz @ Ian Staines on Jun 2, 2020 12:07 PM
      Mark Correct
      Correct Answer
      Account Access and Ownership
      Like • Show 0 Likes0
      Actions
      - Mostafa Helmy @ Shlomo Katz on Jun 2, 2020 12:31 PM
        Mark Correct
        Correct Answer
        Would you be able to share the full review filters? Might be some conflicting conditions causing this.
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Mostafa Helmy on Jun 2, 2020 12:48 PM
        Mark Correct
        Correct Answer
        This is the account filter without the "IS Disabled"
        (
        accounts.id in groups ('CN=Full name redacted")
        and accounts.Description not like '%Admin%'
        and accounts.Description not like '%Test%'
        and accounts."Display Name" not like '%Test%'
        )
        Like • Show 0 Likes0
        Actions
      - Ian Staines @ Shlomo Katz on Jun 2, 2020 12:52 PM
        Mark Correct
        Correct Answer
        I am not aware of any (general) reason this should not work.
        
        I tested this in my lab and it worked correctly to show only accounts that were not disabled.
        Like • Show 0 Likes0
        Actions
        Shlomo Katz @ Ian Staines on Jun 2, 2020 1:47 PM
        Unmark Correct
        Correct Answer
        Thank you Ian Staines for confirming that "it should work".
        I re-did the filter with the Simple UI versus the Advanced UI.
        This "resolved" my issue.
        
        Much appreciated.
        Like • Show 0 Likes0
        Actions
Ian Staines Jun 2, 2020 2:13 PM
Mark Correct
Correct Answer
Not sure what might have been wrong with the "Advanced" filter view.

Perhaps you can compare the results (in the Advanced view) of the queries built using the different methods?

The Advanced queries use quite a different code path compared to the Simple one. The Advanced query editor allows for free form input and then it validates that the SQL syntax is correct when you save it. This is not a trivial computing task.

My recommendation is to use the simple query editor whenever possible as it is most likely to produce valid SQL. Reserve the Advanced editor for queries that absolutely cannot be created in the simple editor. Do not just use the Advanced editor arbitrarily.

Or if you do use the advanced editor, try converting it back to a simple query as an additional check to validate that your SQL syntax is actually correct.
Like • Show 1 Like1
Actions
- Shlomo Katz @ Ian Staines on Jun 2, 2020 5:13 PM
  Mark Correct
  Correct Answer
  Thank you for the advice.
  There seems to be a difference in the way the AD group was encapsulated.
  Like • Show 0 Likes0
  Actions

Account review - unable to filter out Disabled Accounts

Outcomes

Related Content

Recommended Content