Out of Compliance for your License Count?
If you exceed the number of permitted user accounts, a warning will be displayed in InstructorSite on the page that appears after clicking "Users" on the menu. The warning looks like this:
Background
Licenses and subscriptions allow for a predetermined number of user accounts. Our agreements mandate that, at a minimum, every employee is required to have a user account. If you create any additional user accounts for contractors or others, they will also be accounted for in the cost of your subscription. If you exceed the number of user accounts in your subscription, an adjustment will be made to the renewal invoice to bring your subscription into compliance. If you are concerned that the number of user accounts in UniversitySite isn't accurate, keep reading.
Important
We do not lock out users who may exceed the license number or otherwise shut down access to your site based on this number. It is only used to update billing as previously mentioned.
Service Accounts
We find that "service accounts" are frequently imported by mistake. Since they don't represent real people, we recommend removing them to avoid being charged for them. Adjust your user sync to exclude all service accounts.
What do I do if I see more user accounts than expected?
Check your license agreement; in many cases, as a minimum, a user account is required for every employee.
Adjust your user sync to exclude all service accounts and any other accounts that you don't want to be included in your UniversitySite License count.
- Arrange with support to disable all manually (non-user sync) created user accounts in UniversitySite. We will do this by SQL script on our end and can provide you a list of users who would be disable first upon request.
- If you still have accounts in UniversitySite that are active that shouldn't be, work with your internal technical contact in charge of your user sync to modify your sync or source data so that this and other accounts like it are disabled next time the sync runs.
If you still are out of compliance after adjusting your sync to remove all service accounts, please contact sales to discuss licensing more user accounts for UniversitySite.
How do I adjust my user sync to exclude service accounts or other non-user accounts?
The user sync is normally located on one of your web servers at:
c:\program files (x86)\Profiscience Partners\Active Directory import (sometimes User sync)\ActiveDirectoryImport.exe
To update your user sync (either AD or Database) to exclude service accounts, open the ActiveDirectoryImport.exe, click the Setup tab, and click the Edit button.
Active Directory user sync
The AD User sync uses LDAP query language to filter the users included in the sync, so the AD Filter field will be the place to focus your efforts.
The default filter many of you will be using because you want Office (physicalDeliveryOfficeName) to be synced to UniversitySite user location will be
(&(objectCategory=person)(objectClass=User)(sn=*)(givenname=*)(mail=*)(physicalDeliveryOfficeName=*))
Some of you will have instead be syncing the City (l)
(&(objectCategory=person)(objectClass=User)(sn=*)(givenname=*)(mail=*)(l=*))
These two filters mean that you want only persons, users, who have a first (givenname) and a last name (sn) and an email address and a city (l) or office (physicalDeliveryOfficeName) that is NOT blank. The =* part means not blank but contains some value there.
We cannot tell you exactly how you will need to modify your AD Filter using LDAP query syntax to remove additional unwanted users in your system because there are too many variables based on your user data structure. Please seek internal assistance from someone in your organization who is very familiar with LDAP queries and your user data in Active Directory.
When you click the Preview button, you will see the current count of users matching the filter criteria (enabled and disabled). You will want to make a note of the count before and after making your changes by clicking preview before making those changes and after as well.
IMPORTANT: Disabled user accounts do NOT affect your license count
What if we do not disable outgoing users in Active Directory?
If, for some reason, your process for handling inactive users is something other than using the Account status in AD (userAccountControl), then you may have many more accounts present in your sync than you really have active users. Therefore, you will need to modify your AD Filter to exclude these no longer active (but technically still enabled) user accounts. Unfortunately, we cannot provide specific guidance on how to do this. Please consult an internal resource that is very familiar with your AD data structure and LDAP query language.
What if we cannot modify our AD sync to exclude the unwanted accounts?
You may prefer to switch to using database sync (preferably using a view you create in a database source)
If you want to switch to using database sync, contact support, and we can help you make this transition at no cost to you. The process is fairly straightforward so long as you can create a database view to use as your data source and ensure your data doesn't include blanks or duplicates for any of the following fields:
- email address
- Network Alias
- Unique Identifier field you chose (such as Guid)
Database source user sync
If you have a database sync rather than AD, it should be relatively easy to correct this problem.
You can filter out unwanted service accounts by either updating the view you are using as your database source OR, if you aren't using a view, update the DB Select query to pull data from your database source.
Important Note about handling disabled accounts