Symantec Identity Management

Expand all | Collapse all

EtaUtil to find All Extraneous Accounts

Jump to Best Answer
  • 1.  EtaUtil to find All Extraneous Accounts

    Posted 09-11-2019 01:36 AM
    Hi Team,

    I am trying to check if there is a way to find out all accounts which are correlated to Global User (All Users) but does not have role synchronized properly.

    For single users we are able to check Role Sync option in UI. I am thinking to list all effected users with this Role Sync problem. I could not find matching Etautil command to achieve this task.

    Please let me know.


  • 2.  RE: EtaUtil to find All Extraneous Accounts
    Best Answer

    Posted 09-11-2019 06:45 AM


    There is a report option in etautil for this purpose but it's more designed per user. You can try it with * but the output may not be easy to parse. The command is:

    etautil -u etaadmin -p apassword report 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser GlobalUserName=* list eTSyncUsers eTSyncDelete >report.txt

    The output via ldapsearch can be easier, the equivalent command is:

    ldapsearch -x -H ldap://impshostname:20389 -D "eTGlobalUserName=etaadmin,eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta" -W -b "eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta" (objectClass=eTGlobalUser) eTSyncUsers eTSyncDelete

    You can adapt the filter to target a specific set of users and also redirect the output to a file.

    For every out of sync user, the output should be like:

    # J L, Aston Martin, cmdemoadd, ActiveDirectory, im, eta

    dn: eTADSAccountName=J L,eTADSOrgUnitName=Aston Martin,eTADSDirectoryName=cmde


    eTADSAccountName: J L

    eTADSsAMAccountName: user03

    eTPolicyDN: eTADSPolicyName=AT_AD01,eTADSPolicyContainerName=Active Directory


    eTSyncUserDN: eTGlobalUserName=user03,eTGlobalUserContainerName=Global Users,e


    eTSyncUsers: 1

    eTSyncDetail: Missing account

    Missing account means that either the account doesn't exist or it exists but the AT is missing. Extra account can be also reported meaning that the account exists while it shouldn't or the account has an AT that is not prescribed by any assigned role(s)

    Hope that helps

  • 3.  RE: EtaUtil to find All Extraneous Accounts

    Posted 09-11-2019 07:38 AM
    Hi Jeff,

    Thank you for this information. I got the direction to move ahead. I will try this. 


  • 4.  RE: EtaUtil to find All Extraneous Accounts

    Posted 09-11-2019 07:38 AM

    Hi Jeff,


    Thanks for this information. I will give this a try.