How to Disable the AD Account automatically from ServiceNow, once we have a new Task for ac. disable

Anuj30
Tera Contributor

4 weeks ago

How to Disable the AD Account automatically from ServiceNow, once we have a new SC Task for account disable in Servicenow ?

0 Helpfuls
  • 448 Views
10 REPLIES 10

M Iftikhar
Tera Sage

4 weeks ago - last edited 4 weeks ago

Hi @Anuj30 ,

To disable an Active Directory (AD) account automatically when a Service Catalog (SC) Task for account disable is created, you can use ServiceNow’s capabilities:

  1. Configure a Flow in Flow Designer (or a Workflow) that triggers on the creation of a “Disable Account” SCTASK.

  2. Use the Disable AD User Account  activity to deactivate the AD account by passing the required user attributes (e.g., sAMAccountName, email, or DN).

  3. Ensure the MID Server has proper AD permissions and credentials stored securely in ServiceNow.

  4. Optionally extend the Flow to log results, send notifications, and handle error cases.

This approach is commonly used in HR offboarding automation to ensure timely and compliant account disablement.

🔗References:

 

Thanks & Regards,
Muhammad Iftikhar
If my response helped, please mark it as the accepted solution so others can benefit as well.

Thanks & Regards,
Muhammad Iftikhar

If my response helped, please mark it as the accepted solution so others can benefit as well.

0 Helpfuls

Viraj Hudlikar
Tera Sage
Tera Sage

4 weeks ago

Hello @Anuj30 

 

Use Flow Designer to create a Flow that triggers upon the completion (or creation/update to a specific state) of the SC Task. Within the Flow, leverage the IntegrationHub Microsoft Active Directory Spoke's "Disable User" action to connect to your AD environment via a MID Server and automatically disable the specified AD account.

Some reference which will be helpful.

https://www.servicenow.com/docs/csh?topicname=ms-ad-v2-spoke.html&version=latest

https://noderegister.service-now.com/kb?id=kb_article_view&sysparm_article=KB1284583

 

If my response has helped you, hit the helpful button, and if your concern is solved, do mark my response as correct.

 

Thanks & Regards
Viraj Hudlikar.

0 Helpfuls

Anuj30
Tera Contributor
In response to Viraj Hudlikar

4 weeks ago

Hi Viraj,

 

We do not have Azure AD Spoke subscription, we want to do it by custom integration

 

0 Helpfuls

Viraj Hudlikar
Tera Sage
Tera Sage
In response to Anuj30

4 weeks ago

Hello @Anuj30 

 

Use Flow Designer (or Workflow) with a custom-built Action (if using Flow Designer) or Custom Activity (if using Workflow). This custom component will execute a PowerShell script on the MID Server that contains the Disable-ADAccount cmdlet, passing the target AD user's identifier from the SC Task as an input parameter.

Reference links:
https://incident.do/2023/11/22/ad-spoke-substitute-running-powershell-scripts-from-a-servicenow-mid-...

 

https://activedirectorypro.com/disable-multiple-users-in-active-directory/#:~:text=In%20this%20examp...

 

If my response has helped you, hit the helpful button, and if your concern is solved, do mark my response as correct.

 

Thanks & Regards
Viraj Hudlikar.

0 Helpfuls