Disabled Users Not Removed From Local Group
Hello Beekeepers community!!!
We currently add Active Directory (AD) users to local BT Group security groups for access management. However, we have identified a concern regarding user lifecycle management and audit compliance.
At present, when a user account is disabled or becomes inactive in Active Directory, the user is not automatically removed from the local group(s) to which access was previously granted. As a result, the group membership does not accurately reflect the list of active users.
For example:
- Local group: BT-PAM-ACCESS
- Total members displayed: 10 users
- Actual active users: 8 users
- Disabled users in AD: 2 users
Even though the 2 users are disabled in Active Directory, they continue to appear as members of the local group. During audits, we provide screenshots of the local group membership as evidence of access reviews. This results in audit evidence showing all 10 users, which can be misleading because it includes accounts that are no longer active.
Concern: The current process does not automatically synchronize group membership with the Active Directory account status, creating a risk of inaccurate audit evidence and potential compliance concerns.
Requirement: We would like to implement an automated solution that removes users from local access groups when their corresponding Active Directory accounts are disabled or inactive. This would ensure:
- Accurate group membership records.
- Improved access governance and compliance.
- Reliable audit evidence.
- Reduced manual effort in access reviews.
Could anyone please advise on the best approach to achieve this automation?
