<div dir="ltr">Hey,<br><br>I saw you were running into that on-resource/off-resource error. That usually happens when you mix objectClass and ownedBy in the same shadow query.<br>A much easier and faster way to find orphaned accounts is to use the synchronizationSituation attribute. Instead of checking if an account has no owner, you can just filter for accounts that are not LINKED. It completely avoids that error.<br>Here’s what the query looks like in MQL:<div><div style="background-color:rgb(30,31,34);color:rgb(188,190,196)"><pre style="font-family:"JetBrains Mono",monospace"><span style="background-color:rgb(41,60,64)">resourceRef matches (oid = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx") and kind = "ACCOUNT" and intent = "Account" and synchronizationSituation != LINKED<br></span></pre></div></div><div><font face="arial, sans-serif">Or xml way:</font></div><div><div style="background-color:rgb(30,31,34);color:rgb(188,190,196)"><pre style="font-family:"JetBrains Mono",monospace"><span style="color:rgb(213,183,120)"><filter><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:and><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:ref><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path></span>resourceRef<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value </span>oid<span style="color:rgb(106,171,115)">="</span>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx<span style="color:rgb(106,171,115)">"</span><span style="color:rgb(213,183,120)">/><br></span><span style="color:rgb(213,183,120)"> </</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:ref><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:equal><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path></span>kind<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value></span>ACCOUNT<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value><br></span><span style="color:rgb(213,183,120)"> </</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:equal><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:equal><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path></span>intent<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value></span>Account<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value><br></span><span style="color:rgb(213,183,120)"> </</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:equal><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:not><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:equal><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path></span>synchronizationSituation<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:path><br></span><span style="color:rgb(213,183,120)"> <</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value></span>linked<span style="color:rgb(213,183,120)"></</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:value><br></span><span style="color:rgb(213,183,120)"> </</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:equal><br></span><span style="color:rgb(213,183,120)"> </</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:not><br></span><span style="color:rgb(213,183,120)"> </</span><span style="color:rgb(199,125,187)">q</span><span style="color:rgb(213,183,120)">:and><br></span><span style="color:rgb(213,183,120)"></filter></span></pre></div></div><div>Kind Regards</div><div>Lubo</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">pi 12. 6. 2026 o 12:42 Robbe Caes via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>> napísal(a):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg2028232368380866050">
<div dir="ltr">
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hi, </div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
We are having trouble generating a report of orphaned accounts on our AD resource.</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
We have tried many different filters and syntaxes to come up with a solution for this but nothing has worked.</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
The most common error we get is: </div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Cannot combine on-resource and off-resource properties in a shadow search query. Encountered filter 'AND(REF: resourceRef, PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null), targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent,
PPV(String:Account); EQUAL: objectClass, PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD ({.../common/common-3}FocusType),null,null)))'</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Our current filter looks like this: </div>
<div>
<pre><div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"><filter><br> <q:and><br> <q:ref><br> <q:path>resourceRef</q:path><br> <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/><br> </q:ref><br><br> <q:equal><br> <q:path>kind</q:path><br> <q:value>ACCOUNT</q:value><br> </q:equal><br><br> <q:equal><br> <q:path>intent</q:path><br> <q:value>Account</q:value><br> </q:equal><br><br> <q:equal><br> <q:path>objectClass</q:path><br> <q:value xmlns:ri="<a href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" target="_blank">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>">ri:user</q:value><br> </q:equal><br><br> <q:not><br> <q:ownedBy><br> <q:type>FocusType</q:type><br> </q:ownedBy><br> </q:not><br> </q:and><br></filter></div><div style="white-space:normal;font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"><br></div><div style="white-space:normal;font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">We have also tried using marks on accounts without owners to then filter on these marks but this does not work either.</div><div style="white-space:normal;font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"><br></div><div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">Does anyone have a solution for this? If so, please let me know how we can implement this.</div></pre>
</div>
<div id="m_2028232368380866050Signature">
<table id="m_2028232368380866050x_zs-output-sig" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;width:700px;color:rgb(60,54,58);box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<table id="m_2028232368380866050x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:14px;padding-bottom:14px;width:inherit;height:inherit">
<p style="text-align:left;line-height:14px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:12px;color:rgb(0,1,98);line-height:14px">Kind Regards,</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<table id="m_2028232368380866050x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:22px;padding-bottom:2px;width:inherit;height:inherit">
<p style="text-align:left;line-height:22px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:20px;color:rgb(0,1,98);line-height:22px;font-weight:600">Robbe Caes</span></p>
</td>
</tr>
<tr>
<td style="text-align:left;line-height:18px;padding-bottom:12px;width:inherit;height:inherit">
<p style="text-align:left;line-height:18px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:16px;color:rgb(255,84,0);line-height:18px;font-weight:600">IGA Specialist</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<table id="m_2028232368380866050x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;padding-right:20px;width:inherit;height:inherit">
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Arial,Helvetica,sans-serif;font-size:0px;color:rgb(60,54,58);line-height:0px"><a href="https://www.acen.eu/" id="m_2028232368380866050OWA74ae1146-e43e-2689-e72c-e82ec6f53314" rel="nofollow" style="text-decoration:none;margin-top:0px;margin-bottom:0px" target="_blank"><img alt="Logo" width="178" height="87" style="width: 178px; height: 87px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/2440cd65-5ed6-4e84-879d-6d6147718078/-/resize/356x174/image.png"></a></span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td style="text-align:left;line-height:0px;background-color:rgb(255,84,0);vertical-align:top;width:2px;height:inherit">
</td>
<td style="text-align:left;line-height:0px;padding-right:20px;width:inherit;height:inherit">
</td>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;padding-right:8px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Arial,Helvetica,sans-serif;font-size:1px;color:rgb(60,54,58)"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png"></span></p>
</td>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:12px;color:rgb(0,1,98);line-height:14px">+32 496 18 01 60 </span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align:left;line-height:0px;padding-bottom:6px;width:inherit;height:inherit">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;padding-right:8px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Arial,Helvetica,sans-serif;font-size:1px;color:rgb(60,54,58)"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png"></span></p>
</td>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:12px;color:rgb(0,1,98);line-height:14px"><a href="mailto:robbe.caes@acen.eu" id="m_2028232368380866050OWAa811960e-f7dd-d9d3-24ee-93391f4f3bde" rel="nofollow" style="color:rgb(0,1,98);text-decoration:none;display:inline;margin-top:0px;margin-bottom:0px" target="_blank">robbe.caes@acen.eu </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align:left;line-height:0px;padding-bottom:6px;width:inherit;height:inherit">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;padding-right:8px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Arial,Helvetica,sans-serif;font-size:1px;color:rgb(60,54,58)"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png"></span></p>
</td>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:12px;color:rgb(0,1,98);line-height:14px"><a href="http://www.acen.eu/" id="m_2028232368380866050OWA0400ba93-8f6e-a639-ece9-e541f85965a8" rel="nofollow" style="color:rgb(0,1,98);text-decoration:none;display:inline;margin-top:0px;margin-bottom:0px" target="_blank">www.acen.eu </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align:left;line-height:0px;padding-bottom:6px;width:inherit;height:inherit">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;padding-right:8px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Arial,Helvetica,sans-serif;font-size:1px;color:rgb(60,54,58)"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png"></span></p>
</td>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:12px;color:rgb(0,1,98);line-height:14px"><a href="https://maps.app.goo.gl/M4nC67m22KWx2XE2A" id="m_2028232368380866050OWAe17814bc-789c-9ba5-7b92-00e49145d5af" rel="nofollow" style="color:rgb(0,1,98);text-decoration:none;display:inline;margin-top:0px;margin-bottom:0px" target="_blank">Veldkant
7, 2550 Kontich </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align:left;line-height:0px;padding-bottom:6px;width:inherit;height:inherit">
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<table id="m_2028232368380866050x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align:left;line-height:0px;margin:0px;box-sizing:border-box;border-collapse:collapse;border-spacing:0px">
<tbody>
<tr>
<td style="text-align:left;line-height:0px;padding-right:8px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Arial,Helvetica,sans-serif;font-size:1px;color:rgb(60,54,58)"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png"></span></p>
</td>
<td style="text-align:left;line-height:0px;width:inherit;height:inherit">
<p style="text-align:left;line-height:0px;margin:0.04px">
<span style="font-family:Montserrat,sans-serif;font-size:12px;color:rgb(0,1,98);line-height:14px;font-weight:700"><a href="https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following" id="m_2028232368380866050OWA523535ae-8be1-1d45-60d8-0c04a7c5952f" rel="nofollow" style="color:rgb(0,1,98);text-decoration:none;display:inline;margin-top:0px;margin-bottom:0px" target="_blank">Follow
us </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align:left;line-height:0px;padding-bottom:6px;width:inherit;height:inherit">
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align:left;line-height:0px;padding-bottom:16px;width:inherit;height:inherit">
</td>
</tr>
</tbody>
</table>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div></blockquote></div>