Ensign Ensign
Ensign
542 views

Recovery of deleted admin user account

Jump to solution

Hi Community members,

 

I have an urgent query and would appreciate some quick responses.

I have accidently deleted another admin user from the system and wanted to know if there is a way to recover the deleted user ? OR atleast a way to recover the deleted user's personal resource eg:- active lists, Active channels etc.

Tags (2)
0 Likes
1 Solution

Accepted Solutions
Micro Focus Expert
Micro Focus Expert

Hi,

I regret that you are unlikely to be able to recover the user's content unless it has been copied elsewhere first, or was exported or sync'd to another ESM server.

When you delete a user,  the associated content for that user are removed from the database.

As a check,  I decided to test this locally for an admin user, and then checked the database manually for any remnants of the content - the result was that all those resources were removed from the resource tables.

Do you have any recent system table exports in /opt/arcsight/manager/tmp?  If you do. then you could possibly build a temporary ESM server and load them onto it to find and export the user's content to a package that could be potentially imported into your other ESM.   If the ESM versions are very different then there could be some issues with the export/import if they depend on attributes that have changed in the database,  but essentially this should work.

Sorry not to have better news.

Best regards,

Darren

ArcSight Support
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.

View solution in original post

0 Likes
1 Reply
Micro Focus Expert
Micro Focus Expert

Hi,

I regret that you are unlikely to be able to recover the user's content unless it has been copied elsewhere first, or was exported or sync'd to another ESM server.

When you delete a user,  the associated content for that user are removed from the database.

As a check,  I decided to test this locally for an admin user, and then checked the database manually for any remnants of the content - the result was that all those resources were removed from the resource tables.

Do you have any recent system table exports in /opt/arcsight/manager/tmp?  If you do. then you could possibly build a temporary ESM server and load them onto it to find and export the user's content to a package that could be potentially imported into your other ESM.   If the ESM versions are very different then there could be some issues with the export/import if they depend on attributes that have changed in the database,  but essentially this should work.

Sorry not to have better news.

Best regards,

Darren

ArcSight Support
If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.

View solution in original post

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.