Disabling Directory Sync Users

Document created by user.oxriBaJeN4 Employee on Sep 14, 2015Last modified by user.oxriBaJeN4 Employee on Apr 2, 2019
Version 7Show Document
  • View in full screen mode

Mimecast processes emails based on your organization's internal domain email addresses. These serve as a unique identifier for each user's Mimecast archive. These email addresses can exist in the following forms:

  • Cloud user accounts that only exist in Mimecast.
  • Directory user accounts that are synchronized from your organization's infrastructure.

If you need to revoke access (e.g. when a user leaves your organization) it is important this is done on both the cloud and directory user accounts.

This relies on the automatic linking of aliases, configured in your Account Settings.

Disabling Cloud User Accounts


When an account is disabled on the directory (i.e. the "useraccountcontrol" attribute in your Active Directory is set to a value of 514). Mimecast automatically also disables the user cloud account when the next directory synchronization is performed. To prevent a user from being able to log in to their Mimecast account using their cloud password before the next directory sync is performed, the user's cloud account must be manually disabled via the Administration Console.


Directory Resource Forest Environments


Using Mimecast Directory Sync with your organization's directory resource forest, both the Exchange domain and the user domain information is synchronized.  This can cause a single user to have two Active Directory accounts; one enabled in the user domain, and one disabled in the Exchange domain. Consequently, when Mimecast synchronizes with each domain, the user's Mimecast account will be disabled and then enabled, or vice versa. This may result in users not being able to log in to Mimecast applications.


To prevent from occurring, the permissions for the Mimecast Directory Sync user account can be changed to override the user objects in the Exchange domain of the resource forest where the disabled user accounts reside. Setting an explicit deny permission for the Mimecast Directory Sync user account will prevent the “Account Disabled” setting in the Mimecast platform from changing. This can be accomplished with a single permission change for the Directory Sync user, or alternatively, on an individual user basis.

Organizations not using Mimecast Directory Sync with your organization's directory resource forest, may have both enabled and disabled user accounts for the same users in the Directory structure. In this instance Mimecast recommends hiding the disabled users from the Mimecast Directory Sync user, which will avoid their Mimecast account being disabled.

Updating the Directory Sync User (Recommended)


  1. Open a command prompt as an administrative user.
  2. Enter the following command:


dsacls "OU=Unit,DC=domain,DC=local" /I:S /D DOMAIN\user:RP;useraccountcontrol;user



      • “OU=Unit,DC=domain,DC=local” is the domain of the OU where your user accounts reside
      • DOMAIN\user is the domain and username of the Mimecast Directory Sync User


Individual User Update: Active Directory Users and Computers


Use this option to affect individual user accounts only.

If using this option, it is important to update each user account that needs to access Mimecast applications.

  1. Open Active Directory Users and Computers as an administrative user, ensuring the Exchange domain where user accounts are disabled is displayed.
  2. Ensure that Advanced Features is selected from the View menu in the MMC Snap-In.
  3. Locate the User to be changed.
  4. Open the user's Properties.
  5. Select the Security tab.
  6. Select the Advanced button.
  7. Select the Add button.
  8. Enter the name of the Mimecast Directory Sync User, select Check Names, and click the OK button.
  9. Select the Properties tab from the Permission Entry dialog.
  10. Scroll down to find the Read userAccountControl value.
  11. Select to Deny this permission.
  12. Click OK on each of the three open properties dialogue boxes to apply the permission.


See Also...