Stop LDAP inserting AD disabled users into sys_user table

jimpaige · ‎10-31-2016

Hi all,

We have started to query an OU to deactivate users with userAccountControl values of 514 and 546 (former employees are moved to a different OU before the userAccountControl value is changed). When the load is executed inserts are made for users that have never existed in ServiceNow. We only need to update existing records in sys_user and deactivate them, not insert any new records.

We can't get the onBefore transform script below to work:

//Ignore any insert of a disabled record as defined by the 'userAccountControl' attribute

var uc = source.u_useraccountcontrol;

if((uc == '514' || uc == '546') && action == 'insert'){

ignore = true;

}

Is the above script for this purpose or am I missing something?

Thanks,

Jim

Michael Fry1 · ‎10-31-2016

Did you review the out of the box onBefore script:

//Convert the userAccountControl attribute to a hex value

var ctrl = parseInt(source.u_useraccountcontrol, 10);

ctrl = ctrl.toString(16);

//The relevant digit is the final one

//A final hex digit value of '2' in 'ctrl' means disabled

if (ctrl.substr(-1) == "2") {

target.active = false;

target.locked_out = true;

if (action == 'insert')

ignore = true;

} else {

//Optional: Reactivate and unlock the user account

//target.active = true;

//target.locked_out = ctrl.substr(-2, 1) == "1";

}

View solution in original post

jimpaige · ‎11-01-2016

Thanks for your help everyone.

Mr. Fry's simple but effective advice was what I needed.

Jim