unable resolve unsecure account attributes alert

%3CLINGO-SUB%20id%3D%22lingo-sub-1552171%22%20slang%3D%22en-US%22%3Eunable%20resolve%20unsecure%20account%20attributes%20alert%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1552171%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20question%20to%20this%20alert%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20message%20is%20shown%20for%20several%20weeks%20now%20and%20I%20searched%20the%20local%20AD%20for%20this%20user%2C%20but%20it%20seems%20that%20the%20account%20does%20not%20exist%20anymore.%20What%20can%20I%20do%20to%20confirm%20the%20alert%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20have%20no%20option%20to%20dismiss%2Fresolve%20the%20open%20alert.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ELook%20at%20the%20image%20attached.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Alert.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F208687i43454D5CE3F31079%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Alert.jpg%22%20alt%3D%22Alert.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1552171%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1555934%22%20slang%3D%22en-US%22%3ERe%3A%20unable%20resolve%20unsecure%20account%20attributes%20alert%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1555934%22%20slang%3D%22en-US%22%3E%3CP%3ECan%20someone%20help%20me%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1562180%22%20slang%3D%22en-US%22%3ERe%3A%20unable%20resolve%20unsecure%20account%20attributes%20alert%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562180%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F291140%22%20target%3D%22_blank%22%3E%40Kailashj%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20might%20be%20caused%20by%20a%20deleted%20account%20that%20has%20an%20unsecure%20attribute%20still%20configured.%20I%20was%20able%20to%20achieve%20a%20similar%20situation%20in%20my%20test%20environment%20with%20the%20account%20that%20had%20%22DES%20encryption%22%20enabled%20when%20the%20account%20was%20deleted.%20UserAccountControl%20attributes%20still%20exist%20(are%20not%20wiped%20out)%20in%20the%20account%20event%20it's%20deleted%20(see%20pics%20-%20first%20one%20from%20ldp%2C%20second%20from%20mcas).%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECould%20you%20search%20the%20account%20from%20deleted%20objects%20container%20and%20verify%20does%20it%20have%20an%20unsecure%20attribute%20still%20configured%20(depending%20on%20what%20it%20is)%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1569707%22%20slang%3D%22en-US%22%3ERe%3A%20unable%20resolve%20unsecure%20account%20attributes%20alert%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1569707%22%20slang%3D%22en-US%22%3E%3CP%3EI%20will%20check%20on%20this%20and%20get%20back%20to%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1569717%22%20slang%3D%22en-US%22%3ERe%3A%20unable%20resolve%20unsecure%20account%20attributes%20alert%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1569717%22%20slang%3D%22en-US%22%3E%3CP%3ENo%20luck%20the%20user%20for%20whom%20the%20alert%20was%20triggered%20couldn't%20be%20found%20anywhere.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Kailashj_0-1596686096486.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F210568i3EE435ADB706B1AB%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22Kailashj_0-1596686096486.png%22%20alt%3D%22Kailashj_0-1596686096486.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F31071%22%20target%3D%22_blank%22%3E%40Sami%20Lamppu%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I have a question to this alert:

 

This message is shown for several weeks now and I searched the local AD for this user, but it seems that the account does not exist anymore. What can I do to confirm the alert?

 

I have no option to dismiss/resolve the open alert.

 

Look at the image attached.Alert.jpg

4 Replies

Can someone help me?

Hi @Kailashj 

 

This might be caused by a deleted account that has an unsecure attribute still configured. I was able to achieve a similar situation in my test environment with the account that had "DES encryption" enabled when the account was deleted. UserAccountControl attributes still exist (are not wiped out) in the account event it's deleted (see pics - first one from ldp, second from mcas). 

 

Could you search the account from deleted objects container and verify does it have an unsecure attribute still configured (depending on what it is)? 

 

I will check on this and get back to you.

No luck the user for whom the alert was triggered couldn't be found anywhere.

 

Kailashj_0-1596686096486.png

 

@Sami Lamppu