After identifying a potentially compromised user account, you can disable the account.
This task is supported by the following services:
-
Microsoft Entra ID
-
Active Directory (on-premises)
-
Okta
-
OpenLDAP
Procedure
- After identifying the potentially compromised user account, access the context
or response menu and click Disable User Account
Task.The Disable User Account Task screen appears.
- (Optional) Specify a description for the task.
- Click Create.
- Monitor the task status.
- Open Response Management.
- (Optional) Locate the task using the Search field or by selecting Force Password Reset from the Action drop-down list.
- View the task status.
-
In progress (): Trend Vision One sent the command and is waiting for a response.
-
Successful (): The command was successfully executed.
-
Partially successful (): The task was unsuccessful on one or more IAM service
-
Unsuccessful (): The task was unsuccessful on all connected IAM services
-