How to recover a deleted user?

Usage and Config Platform
1

Hi,

I’m looking for some way to recover a deleted user, operator site, actions and analysis.

This is what I have at the moment, but I would like to know if I’m missing something…

– 1. Find the UserID, SiteID and SiteTag

<
SELECT
u.Username, u.UserID, u.UserCreationTime, u.LastLoginTime, u.IsDeleted, u.MastheadUsername as OperatorSiteName, u.ApproverRoleID,
s.Name as SiteName, s.ID as SiteID, s.Tag as SiteTag, s.URL
FROM [BFEnterprise].[dbo].[USERINFO] U
JOIN [BFEnterprise].[dbo].[SITES] S
ON u.UserID=s.OpsiteUserID
WHERE u.username like '%[addusername]%'
AND u.IsDeleted = 0
order by u.LastLoginTime desc
/>
–2. Restore user and site

Update [BFEnterprise].[dbo].[USERINFO]
SET IsDeleted = 0
WHERE userID = [adduserID] ;

Update [BFEnterprise].[dbo].[SITES]
SET IsDeleted = 0
WHERE ID = [addSiteID]

–3. Restore Actions

UPDATE [BFEnterprise].[dbo].[ACTIONS]
SET isdeleted = 0
WHERE siteid= [addSiteID]
AND CreatorID = [adduserID]

UPDATE [BFEnterprise].[dbo].[ACTION_FLAGS]
SET IsDeleted = 0
WHERE IssuerID = [adduserID]

–4. Restore Analyses

UPDATE [BFEnterprise].[dbo].[CUSTOM_ANALYSES]
SET IsDeleted = 0
Where CreatorID = [adduserID]

– 5. Execute the following command via cmd to update the users/operator site
BESAdmin.exe /resignsecuritydata

Admin Tool

–6. Verify if the operator site now exits:
D:\Program Files (x86)\BigFix Enterprise\BES Server\wwwrootbes\bfsites\ [addSite TagID]

2 Likes
2

As far as I know, there is no official supported way to restore a user but by restoring an old backup of the database, so I have to discourage you to make these changes.

3

I haven’t had experience with restoring anything other than actions and computers. We are using 9.2.x infrastructure, so I don’t know if this still works in 9.5.x. but this is what we use:

To restore an action:
exec bfenterprise.dbo.undelete_action ActionID
We keep an excel sheet of all deleted actions so we can find the action ID to put in the command. You could also use database queries to find the action ID you want to restore to the console. Note that this does not automatically restore all computers that were targetted in the action. If any computers had obtained a new computer ID or were removed from the console since that action was submitted they would need to be restored separately.

To restore a computer:
UPDATE BFEnterprise.dbo.COMPUTERS set IsDeleted = 0 where ComputerID = ComputerID
You’ll have to query the deleted computers to find the computer ID you want to restore.

You may have to clear the console cache and restart the console to see restored content.

1 Like