Best Practices: Deleting WC user accounts

[LawrenceS]

I have found several PTC articles and a great PTC community post but cannot quite find the answer I am looking for. Ref:

• Windchill Deleted / Deactivated User Process - PTC Community
• Article - CS94203 - How to delete a user from Windchill PDMLink (ptc.com)
• Enabling a Deleted User (ptc.com)

We have never deleted users and now something came up where we may have to in order to match IT Active Directory.  We are not on AD yet but are trying to understand if they give us users with usernames that have already been used by previous employees, what issues that may cause and what workarounds may be available.

I think my confusion are around the following questions:

1. Historically, did this best practice change at some point?  My colleague, and our consultants, tell me it at least used to create lots of problems and was recommended to not delete users.
2. Is it really a best practice to delete users as PTC recommends?
3. For those that delete users, do you (or rather your IT dept) have a process to ensure that new users have a unique username and email address so that it doesn't get reused?
4. What happens if after a user is deleted (e.g. username "Fred123" email  FredBe@mycompany.com ) and then at a later point a completely different new user is created with the same username "Fred123" and/or email address "FredBe@mycompany.com"?
5. If deleting OR reusing usernames and/or email addresses is not recommended, can you direct me to official info or negative experiences that support this?

[cying]

From my experience, if you delete the user account.   When you need to make some changes later on with the username as the author.   you might run into data integrity issues where you can't move or delete something because the user account is no longer exist (WC 11).   The best practice is to create a new group, I.E., No longer with the company and move the user to this group.  This group will not be able to login to windchill or have access to any data.

Hope this helps.

Calvin

[avillanueva]

I've never seen this before and delete all the time.

[TomU]

Same as @avillanueva. Never had any issues deleting users.  It's a fully supported action.  If you're having data integrity issues, then either the user wasn't properly deleted or there is something else going on with your system.

[TomU]

Each user has a unique ID in the database. The same username could be created and then deleted a dozen different times, and each time (under the hood) they are actually different users.  Yes, this can be confusing in advanced searches when the participant name is displayed because you may see multiple users with exact same name.

[STEVEG]

@TomU And there is the issue.  The IT department may assign a past user name to a new user and we won't know who actually is the owner on past work.

[BenLoosli]

You have that many people with same names? We use Last_nameFirst_Initial as our usernames (looslib). Unless I go work for Boeing in CA and they use the same naming format, I should be okay! My cousin is the CAD tool manager at Boeing in Long Beach and his first name is Bruce, so we could both be looslib! We do have different middle initials.

[STEVEG]

Our IT doesn't keep track of past users.  What that means is they might use a username for a new person that was already used for a past employee.  We don't use the full name or email addresses for user names.  We use something like AD10.  If that user is still at our company they the next person with the initials of AD would be AD11, and so on.

Yes I know.  Not ideal but that is what they do.  I have to deal with it.

[avillanueva]

We have users who come and go. Sometimes they get new ID and I've seen where they've issue the same. If I have already deleted their account, it might say John Doe (Deleted) but the new account will say John Doe. The internal id of the wcadmin (IDA2A2) remains but other details get wiped. 

[LawrenceS]

Thank you for your replies.  SteveG and I work at the same company so his questions and answers relate to the same situation.

From what I am gathering, Deleting users is supported, but is more likely to cause problems than not deleting a user.  And if usernames are repeated then it doesn't cause any problem in the system but it is confusing to anyone looking at their work.  So although also supported it introduces new opportunities for things to break.

So for those who delete users, why do you do it?  Why not just leave them in an Obsolete group in WC?  Is it specifically because you don't control new people's usernames (IT does) and you need to provide the exact username even if it has been used before?  Or are there other reasons for deleting users?

[avillanueva]

IT does control usernames in my case and we need to ensure that it’s not possible to access an obsolete or old account and download data. Second, if user does return to company, they start at beginning with zero access and must obtain authorization to all areas all over again. Resurrecting their old account can retain access to areas they may not be allowed to anymore.

[LawrenceS]

Interesting.  We achieve these 2 purposes by putting users in an obsolete group.  We remove them from all groups, change their password, and then put them in an obsolete group so even if they came back and received the same username they wouldn't be able to log in (because different password & no license group on WC12) or even if they could they would have zero permissions.

[avillanueva]

Consider all the contexts, groups and access that was given to the user. If they did come back and needed that account restored, they would pickup where they left off. That's a no-no in my world. So either your find every context and group they were in and remove them or ... just delete the user account.

[ScottMorris]

We go thorough the exciting and manual process of editing the user account for leavers to put them in the "Deleted" organization, add a prefix to their username and remove email address. Then we remove them from all team and groups.

We have lots of people who leave and return, especially interns. They start their access journey new when they return, but we can put them back in our primary organization, update their username and add their email address back so they are using the same account.

[avillanueva]

I think we are at a "Tastes great" "Less Filling' moment. Two options, each with pro/cons. Your choice. @LawrenceS , call it.