iamdoubz
19610777a4
Spec 12 S5: job directoryCheck (hourly) looks up every active user with a directory account; one deleted, disabled there or no longer matched by the user filter is disabled here, sessions ended. Nothing changes when the directory is unreachable or a run would disable most people; the last admin with a password is kept; nobody is re-enabled. Dashboard warning directory_check (system.directoryWarning). The by-id search is a filter object: ldapts string filters send bytes >= 0x80 as UTF-8, so AD's objectGUID never matched. Live test against a Samba 4 AD DC: nested-group admin, the disabled bit, objectGUID, a deleted user disabled.