Jul 28 2020 10:15 PM
I have a question to this alert:
This message is shown for several weeks now and I searched the local AD for this user, but it seems that the account does not exist anymore. What can I do to confirm the alert?
I have no option to dismiss/resolve the open alert.
Look at the image attached.
Aug 03 2020 12:03 AM
Hi @Kailashj
This might be caused by a deleted account that has an unsecure attribute still configured. I was able to achieve a similar situation in my test environment with the account that had "DES encryption" enabled when the account was deleted. UserAccountControl attributes still exist (are not wiped out) in the account event it's deleted (see pics - first one from ldp, second from mcas).
Could you search the account from deleted objects container and verify does it have an unsecure attribute still configured (depending on what it is)?
Aug 05 2020 08:37 PM
I will check on this and get back to you.
Aug 05 2020 08:55 PM