UpdateCacheWithDeletedObjects
UpdateCacheWithDeletedObjects maintains the accuracy of Activate’s Active Directory cache by identifying objects that have been deleted in Active Directory and removing their corresponding cached entries.
Active Directory does not surface deleted (tombstoned) objects in standard directory searches. Without explicit cleanup, cached entries for deleted users, groups, or other directory objects can persist indefinitely. This function prevents that drift and ensures downstream processing operates on an accurate directory state.
Purpose
UpdateCacheWithDeletedObjects synchronises Activate’s Active Directory cache with objects that have been deleted in Active Directory. It removes stale cache entries so provisioning, reporting, and compliance-related processes are always based on current directory data.
This is cache maintenance functionality. It does not evaluate policy, enforce compliance, or initiate provisioning actions.
Operational context
UpdateCacheWithDeletedObjects runs nightly as part of Activate’s standard system maintenance routine.
As part of this scheduled maintenance:
- Directory references are reconciled to account for renamed objects
- Deleted Active Directory objects are removed from the cache
- The full-text search index is refreshed
- General system maintenance tasks are performed
- Reporting and usage statistics are updated
Running this function nightly ensures the directory cache remains accurate even in environments with frequent object deletions or restores.
What the function does
The function maintains cache accuracy by:
- Traversing all configured Active Directory connector scopes, including trusted domains where applicable
- Querying Active Directory’s Deleted Objects container to identify tombstoned objects
- Removing cached entries for deleted objects using their immutable identifiers
- Recording progress so subsequent runs only process newly deleted objects
Why this is required
Deleted Active Directory objects:
- Are excluded from normal directory polling and synchronisation operations
- Will not be automatically removed from the cache
- Can remain referenced by cached group memberships, reports, or historical data
By explicitly cleaning deleted objects from the cache, UpdateCacheWithDeletedObjects prevents:
- Orphaned group membership records
- Inaccurate reporting
- Incorrect compliance or entitlement evaluations
- Gradual accumulation of stale directory data
Behaviour across connector scopes
The function operates recursively across Active Directory connector scopes:
- Unpublished scopes are skipped
- Parent scopes delegate processing to child and trusted domain scopes
- Only leaf scopes that represent directory partitions perform deleted-object processing
This ensures all relevant directory boundaries are covered without duplicating work.
Incremental processing
To avoid reprocessing the same deletions repeatedly, UpdateCacheWithDeletedObjects tracks progress on a per-scope basis using directory update sequence information.
On each run:
- Only objects deleted since the previous successful run are processed
- Progress is recorded at the end of the run
- Subsequent runs resume from the last known point
This design allows the function to run safely and efficiently as part of nightly maintenance.
Behaviour when objects are restored
When an object is deleted:
- It no longer appears in standard directory polls
- Its cached entry is removed by UpdateCacheWithDeletedObjects
If the object is later restored in Active Directory:
- This function does not recreate the cache entry
- The cache entry is recreated only when another process encounters the restored object, such as through a directory lookup, membership evaluation, or synchronisation operation
This separation ensures the cache reflects only objects that are currently present and actively referenced.
Configuration controls
Deleted-object cache synchronisation can be disabled per Active Directory connector scope using a configuration flag.
When disabled:
- Deleted object detection is skipped for that scope
- No cache entries are removed for deleted objects within that scope
Summary
UpdateCacheWithDeletedObjects is a foundational maintenance function that removes cached entries for Active Directory objects that have been deleted.
It runs nightly as part of Activate’s maintenance process, operates independently of compliance or provisioning workflows, and ensures the long-term integrity of the Active Directory cache.