Deactivate groups not coming from LDAP

[rambo1]

Hi team,

Need some suggestion on below case:

We are getting groups via LDAP, but we only get active groups but when groups are deactivated on AD they are removed and are not brought back to ServiceNow to mark them as inactive.

What would be best logic to deactivate groups which are deleted on AD in Servicenow?

for now I am thinking this way:

if in intial import 100 groups got created, in 2nd import if 20 groups are removed in AD .. LDAP brings only 80, so check groups which are not brought from LDAP and deactivate them.

But if load is too heavy this check would impact performance, please let me know if there is any other logic or sample code used in any of your requireements.

Thanks in advace

[Community Alums]

Hi @rambo1 ,

To mark deleted groups in Active Directory as inactive in ServiceNow, you can use the Scheduled Job functionality of ServiceNow along with a PowerShell script to query Active Directory and update ServiceNow accordingly.

Here's an outline of the steps involved:

1. Create a Scheduled Job in ServiceNow that will run on a regular basis (e.g. daily) to check for deleted groups in Active Directory.

2. Write a PowerShell script that will query Active Directory for deleted groups and update the corresponding records in ServiceNow as inactive.

Here's some sample PowerShell code that can be used to accomplish this:

Import-Module ActiveDirectory
$deletedGroups = Get-ADObject -Filter {isDeleted -eq $true -and ObjectClass -eq "group"} -IncludeDeletedObjects
foreach ($group in $deletedGroups) {
    $groupName = $group.Name
    $snGroup = Get-ServiceNowGroup -Name $groupName
    if ($snGroup) {
        $snGroup.active = false
        $snGroup.update()
    }
}

[rambo1]

Can you please explain on where to write this script and what permissions are required to access AD 

[Community Alums]

Hi @rambo1 ,

You need to work with your AD team, this will happen from their side, just give the script to them, that's enough.