Removing or Disabling Inactive User Accounts on a Site

Deleting or Disabling Inactive User Accounts

EFT Server allows you to automatically disable or remove accounts that have been inactive for a period that you specify (1 to 365 days). You can account security on the Site, Settings Template, and per user. The deletion of accounts is captured in the Auditing and Reporting database for reporting.

Deleting a user account deletes the account from the Authentication manager, but does not delete the user's home folder or its contents.

When a High Security Site is created in the Site Setup wizard, the option to delete inactive user and administrator accounts after 90 days is enabled by default. If during Site setup EFT Server detects that one or more administrator accounts already exist, and that the option to delete administrator accounts after 90 days is not enabled or set to a value greater than 90 days, you are prompted to enable or change that setting.

Deleting inactive accounts takes place by use of an internal timer every night at midnight, at Server Startup, and each GetAllSites() response.

Any transition from a non-PCI DSS compliant state to a PCI DSS compliant state, or a change in any date-sensitive value, will reset all data value calculations. For example, if a Site is running in PCI DSS mode, and the administrator disables Remove inactive admin accounts after 90 days, clicks Apply, and then immediately decides to re-enable that option, the date values for all administrator accounts are reset from the time the option is enabled, even if the last login dates for those administrators was <n> days ago. The same reset also occurs if you change the password reset period from 30 days to 60 days; that is, the change itself prompts a reset of all the time-based values for that feature.

To specify automatic deletion or disabling of inactive user accounts on a Site

In the Administrator, connect to EFT Server and click the Server tab.
In the left pane, click the Site that you want to configure, then click the Security tab.

In the Account Security area, select the Disable/Remove account after <n> days of inactivity check box.
Click the list to specify Disable or Remove.
Specify the number of days of inactivity after which the account is deleted or disabled. You can specify from 1 to 365 days. 90 days is the default, per PCI DSS 8.5.5.
Click Apply to save the changes on EFT Server.

On a High Security Site, if you do any of the following and then click Apply, EFT Server does not commit the change, and a warning message appears.

Disable the disable/remove inactive account option for administrators or regular users
Set the inactivity period to a value > 90 days of inactivity
Change the setting from "remove" to "disable"

In the message that appears, you can discard the change or accept the non-compliant setting and provide a reason for using this setting (e.g., if you are using an alternate solution). If you accept the change and provide a reason, the warning and the reason that you provided appear in the PCI Compliance report.