Handling of terminated users

[bobby_hilliard]

First time poster, novice EV admin.

I'm curious as to how others are handling the disabling/deleting of users in and AD/Exch2k3 environment as concerns archiving. It would seem to make sense to get a complete copy of the mailbox prior to the disabling/deleting.

Being the lowly Exch admin, I'm not always privy to the disabling/deletion of accounts until after the fact.

From what I've seen, it appears that setting up a special policy/task is needed, and a manual re-enable/archive/disable would be required.

Any info is appreciated.

Thanks.

[Andy_Lukens]

You need something you can key off of to identify all the accounts for terminated users.  You can then setup a provisioning group in EV keying off of the that unique attribute that uses a different mailbox policy.

We actually have a 'Term' OU in AD.  When an account is terminated, it is moved into that OU along with several other steps.  The provisioning group then applies to all accounts in that OU and uses a mailbox policy which archives all messages immediately (after 0 days).  We haven't yet enabled this functionality, but this is my plan.

[MirrorSphere]

Also, as part of the leavers provisioning group (typically an AD group or OU) and subsequent policy you may want to include all the message class types to ensure that all items are ripped out of the mailbox before it is removed/deleted.  I would also not choose as part of the policy to put shortcuts back into the mailbox. 

www.ev-assist.com 

[Mark_Ludgate]

Also you should consider disabling archiving for the departed users, before deleting or disabling the AD account.

[Tonya_McDuffie]

In theory, having a specific Exchange Mailbox policy run against the "Terminated" OU sounds good, but archiving won't work unless the mailboxes are Unhidden.  When users term in our environment, the mailboxes are hidden so they are no longer seen in the GAL.  So the ability to take advantage of this process depends on if you have the mailboxes hidden or not.

[bobby_hilliard]

Looks like we'll be changing the way we handle terms. Currently, the account is disabled for 30 days before deleting. They are moved to a unique OU, but, the policy currently dictates an immediate disable...which obviously won't cut the mustard with archiving.

So, it appears that I'm going to be much more involved that ever before...handling moving to the OU, monitoring archiving to know when it's done, disabling the archiving and then disabling the user accounts.

I suspected that I didn't have enough to do!

Thanks for all the responses.

Message Edited by bobby hilliard on 01-08-2008 10:28 AM