ts user

Show and manage a user account.

Usage

ts users [<filter>] [-n N] [--csv] [--no-trunc]
ts user <login>
ts user new <login> [--first-name=NAME] [--last-name=NAME] [--directory=SOURCE]
ts user delete <login> [--force]
ts user restore <login>
ts user disable <login> [--force]
ts user enable <login>
ts user unlock <login>

Description

ts users lists every account in order of login name, service accounts aside. Pass a filter to search instead — matched against login name, first name, and last name — and -n to change how many matches come back. The search results have no ENABLED column.

ts user <login> shows one account: its login name and its ID, and for your own account also its first and last name and whether it is enabled. An account can also be named by its ID, or by its login name after its identity source's login prefix and a backslash (CORP\jsmith).

ts user new makes an account ahead of its first sign-in, in the identity source --directory names by its login prefix or name, or by the ID ts identity-sources lists. The source has to be one that will sign the account in: Internal, an Active Directory or LDAP directory, or a provider whose New People is JustInTime (Create an Account). An account in a directory or a provider keeps its password and profile there, and is bound to its identity the first time its person signs in. An Internal account made here has no password until an administrator sets one. Without --directory, the account goes to the one identity source that creates accounts at sign-in, and the command is refused when there is none or more than one. Login names are unique among live accounts, so a name another live account holds is refused.

On every other action, --directory narrows the login to that source's account. You rarely need it: login names are unique among live accounts, and where deleted accounts share a name, the server's refusal says how to name the one you mean.

ts user delete disables the account and signs it out, removes its personal workspace, ends its sessions and cloud storage grants, and takes it out of listings. It also erases the account's personal data from the server's other stores: records kept by the account's ID, such as its usage, stay, but read Former user where they held its name. The audit log keeps its names. A delete that would leave Administrators with no enabled member is refused. ts user restore brings the account back, enabled, with its newest personal workspace; the credentials it held before stay ended, and where another account has taken its login name since, it gets a free one. enable does not find a deleted account; restore it instead.

ts user disable signs the account out everywhere and stops it signing in, and ts user enable lets it sign in again. Like a delete, a disable that would leave Administrators with no enabled member is refused. ts user unlock clears the run of failed password sign-ins that made an account wait, locked it, or made it need a password reset. It works when every administrator is locked out, because ts --local needs no password sign-in.

Creating, deleting, restoring, disabling, enabling, and unlocking accounts are all recorded in the audit log. To move accounts from one identity source to another, use ts identity-source move.

Options

Flag	Description	Default/Values	Notes
--first-name	First name for a new account.		new only.
--last-name	Last name for a new account.		new only.
--directory	Identity source, by login prefix or name.		For new, where the account is made. For the other actions, whose account the login names.
--force, -f	Delete or disable without confirming.		delete and disable only.
-n, --number	Maximum search results.	Default 50	ts users with a filter only.
--csv	Tab-separated output, nothing truncated.		ts users only.
--no-trunc	Do not truncate columns.		ts users only.

Examples

# Everyone
ts users

# Find someone
ts users smith

# What is this account?
ts user jsmith

# A new Internal account
ts user new contractor1 --first-name=Sam --last-name=Rivera --directory=Internal

# An account for someone in the corporate directory, ahead of their first sign-in
ts user new rlee --directory=CORP

# Someone left
ts user delete jsmith --force

# Someone came back
ts user restore jsmith

# Stop an account signing in without deleting it
ts user disable jsmith --force

# An administrator locked out by failed password attempts
ts --local user unlock admin

Output

USERNAME  FIRST NAME  LAST NAME  ENABLED  ID
admin     admin                  yes      5b3b91f5-7ff6-4615-b8b3-a26e30d03c16
jsmith    Jamie       Smith      yes      c41f0d8a-2b77-4c19-9e0a-1d3b6f2e5a90

Exit Codes

0 on success. -1 when no login is given, when a confirmation is declined, and when the server refuses the change: no identity source to make the account in, a source that would not sign it in, a login name another account holds, a delete or disable that would leave Administrators with no enabled member, or a restore of an account that is not deleted. -4 when no account is signed in. -5 when the account is not a Server Administrator, for everything but printing one account. -6 when the login does not exist, including a deleted account named to disable, enable, or unlock.

Related Commands

• ts group — Group membership, which is how permissions are granted.
• ts identity-source — The identity sources --directory names, and moving accounts between them.