Steffi,
Again sorry for the late reply and also in advance for any questions that may be obvious, but I am truely an IDM novice.
I followed what I thought to be your advice (swapping the priv and system) and have the following results:
1. I had to update the "Minus" to be "except" because of the version of SQL we are on but the scirpt seemed to work except that I got some wierd results when i tested directly in SQL. It seems that it pulled all of my profiles and IDM business roles as being the ID's that needed to be updated, and not any "User ID's". (this happened in both QAS and PRD)
Sould this only pull the differences User MSKeys that don't have the system priv?
I have also created the following job in our QAS environment and am wondering if you could look at it and give me a thumbs up or down?
IF this is right and what I am seeing in my first question is acceptable then how would I just test this with one users ID that I know is not correct?
@Matt - Do you have a link to a script that would perform that? I would also have the same question as to whether I can valdiate it with a single user ID first before I go and run it against the whole system.