Quantcast
Channel: Microsoft Identity Manager forum
Viewing all articles
Browse latest Browse all 7443

Idea to automate the clean-up of orphaned EREs

$
0
0

Hi again.  I'm after some anecdotal/theoretical assessment on an idea I have successfully implemented in a lab just now to clean up 13000 orphaned EREs.  I am considering implementing this idea in the Production environment, but I want to find out if there are any good reasons why NOT to do this ... particularly as it strikes me that if orphaned EREs were supposed to be deleted immediately they become orphaned then this would be OOTB FIM functionality!!!

What I have done is created the following:

  • a set (Orphaned EREs) defined as "Select expected rule entry that match all of the following conditions:
    Resource Parent not in All Objects"
  • a workflow (Delete orphaned EREs - run on policy update = ON) invoking a custom activity to delete an /ExpectedRuleEntry[ObjectID='[//Target/ObjectID]']
  • a set transition MPR (Orphaned ERE objects are automatically deleted) to invoke the above workflow whenever an ERE falls into the above set

The above worked like a charm, deleting all 13K orphaned EREs in an hour or two.

Question is ... what are the implications (besides a little CPU overhead) on running such a "housekeeping" activity in a production environment?  I was thinking of making the set temporal based on one of the many DateTime attributes on an ERE, but it is not clear which one to use ... but leaving this to run at say 1 am every night might actually be more of an overhead than running it as and when an ERE is orphaned.

Thoughts anyone?

TIA


Bob Bradley, www.unifysolutions.net (FIMBob?)

Viewing all articles
Browse latest Browse all 7443

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>