Disabling SN account swhen AD account is moved to the disabled user OU

daniellethomson · ‎01-31-2017

The OoB functionality to disable SN accounts if the corresponding AD user account is disabled works perfectly, except in our environment. Our current process is to move the accounts to another OU=disabled users. I looked at other options such as tracking the last refresh time of the account but we need a more immediate option. Is there a way the OoB script can be modified to disable the SN user account if the OU changes/if the account is no longer visible in the user OU?

bjhughey164 · ‎02-01-2017

Danielle,

I have a data source for each OU that I need to import even though they're all pulling the same attributes. In our environment, a user can move from one to another depending on their job role so, I need to capture all of this, right? The terms hit their own OU during that process and have to remain there for X amount of days based on corporate policy. So, I just pull that termed OU as it's own source and then run the script above.

When you do the imports this way, you can also get granular reporting on just that data source and you're also able to troubleshoot specific users and groups more effectively than doing one giant pull.

View solution in original post

daniellethomson · ‎02-01-2017

Thanks Ben. I don't believe ours was initially set up this way so I'm trying to deconstruct what is currently in place and rebuild.

Nisha30 · ‎02-23-2024

Hi @bjhughey164

can you please share what exact script you referred we are going through same case.

Thanks

Mark Laucus · ‎02-01-2017

My regular User import looks at just the enabled users. We put users in our 'disabled' OU when they leave the organization. There is a percentage which often return to the organization in a different role so we do keep the accounts for history tracking (and move them back to the active OU). By using a different data source, I can utilize this do perform different actions I would want to do with disabled accounts. Note I have not created this different data source yet because I just thought about this a few weeks ago. This is a perfectly timed thread and I just need to do the work.

Mark_Bailey · ‎02-01-2017

Thank you sir.

We do the exact same thing and you just solved my problem I had put on the back burner.

I will create a import looking only on the pending deactivation OU and set active to false on those found there.

For the users found in the regular process I already set those to active.

Wahoo, your win is my win!

Thanks again.

Mark_Bailey · ‎02-01-2017

BTW I want to give you credit and mark as resolved, but I don't see that option on this thread.