Do I remove old AD accounts

Question

Multiple applications use the AD used-id or email address to verify the user within the application. We need to keep the application for 30+ years. AD accounts get removed after 30 days. When someone gets hired that is the same user-id as an old employee there is a conflict within the application. The new employee is not the actual person referenced in the application.

Issues.

1/ I don't want to keep old AD accounts anywhere on AD, even in a separate OU.

2/ I don't want to add a number to a new AD account in case there is a conflict.

Would the best practice be to change the unique identifier within the application to something other then the user-id?
Is this an issue in a lot of places?

Surely there is a best practice?

Thoughts?

Thanks.

Answer 1

Hi @Pio Egan , if I understand your question correctly there are a few ways you can do this. The first is PowerShell. This will remove the users based on your query. You can also do this manually in the portal.

Based on how you add users, you could check if the user-id already exists, and then delete the old one if so (using custom policies and PowerShell). If needed you can check for other user attributes as well.

If I misunderstood your question please let me know and I can help you further. If this answer helped you please mark it as "Verified" so other users may reference it.

Thank you,
James