How to set disabled Active Directory users to inactive in SNOW

[Binu6]

Hello,

What is the best way to disable servicenow accounts for users inactive in Active Directory? Is it transform map or business rule? I have read about creating the UserAccountControl as a field and mapping that field. 

Please advise.

[Michael Jones -]

How are you actually provisioning users in your instance; are you doing so via an LDAP integration, or another method?

If you are using LDAP then, yes, the recommended approach is to use the userAccountControl and a custom field populated on LDAP import/update, and a business rule on update to set the user record to active=false when a value of 514 is populated in that field. That is the best approach that I've seen. 

https://docs.servicenow.com/bundle/paris-platform-administration/page/integrate/ldap/concept/c_Inact...

https://docs.servicenow.com/bundle/paris-platform-administration/page/integrate/ldap/task/t_FindInac...

I hope this helps!

If this was helpful or correct, please be kind and remember to click appropriately!

Michael Jones - Proud member of the CloudPires team!

[Michael Jones -]

You marked my answer as correct and then marked a later answer (with the exactly the same link that I provided and less information) as the correct one. Was that an error or did I miss something in my answer?

I hope this helps!

If this was helpful or correct, please be kind and remember to click appropriately!

Michael Jones - Proud member of the CloudPires team!

[Jesper Hilde]

Hi Michael

I found your answer to be very useful, with the added context of what you did. Especially, since the links both you and the other person provided, does not work anymore, this answer is much more helpful. I found the correct links on the docs.
I hope this reply and the 1 mark of Helpful redeems it just a bit.

If anyone is looking, the updated link I found is this: https://docs.servicenow.com/bundle/tokyo-platform-security/page/integrate/ldap/task/t_FindInactLDAPA...

Thanks again

[Ankur Bawiskar · Accepted solution]

@Binu 

this link from docs has the solution

Find inactive LDAP accounts using the userAccountControl field

Regards
Ankur