PIM Manager settings · Settings > Hybrid AD & workloads
Clean-up: also look for old PIM groups in these OUs
| Key | HybridAdCleanupOus |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | List |
| Default | Blank (only the OU for new AD groups) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
Extra organizational units where the hybrid worker looks for old PIM groups: Active Directory groups that carry the PIM naming but have no definition in PIM Manager any more. The OU for new AD groups is always included. Enter distinguished names, one per line or separated by a semicolon; sub-OUs are included.
When set
When set: from the worker's next run old PIM groups in these OUs are listed on the clean-up review too. Listing deletes nothing: a group is deleted only after a SuperAdmin approved exactly that group on the review.
When blank or default
When blank / at the default: only the OU for new AD groups is looked in. With no OU at all, nothing is ever proposed or deleted.
Risk and how to reverse it
It widens where a SuperAdmin can approve deletions. A group outside the named OUs is never offered and never deleted, whatever its name. Reversible: clear or edit the list; an approval already given for a group that is then outside the OUs is not carried out.
Requires
Pro (On-premises Active Directory feature), a running hybrid worker, and the right to delete group objects in these OUs for the worker's account. SuperAdmin to change.
Recommended
Leave blank unless an earlier installation created its groups in another OU.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack