- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
Seems like our active directory integration to ServiceNow is not working in regard to disabling user ServiceNow account when user is disabled in Active Directory, Please help.
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 weeks ago
The main thing I would check first is the LDAP filter. If disabled AD users are excluded from the LDAP query, ServiceNow never receives those records, so it cannot update the existing users to inactive.
Start by opening System LDAP, then LDAP Servers, and check the User OU Definition. Make sure the LDAP filter is not excluding disabled accounts. If you have a condition that filters out disabled users, remove it so those accounts are included in the import.
Next, confirm that userAccountControl is included in the attributes coming from AD. Then check the transform map and add the logic needed to set active to false when the disabled bit is present. I would use the disabled bit rather than checking only specific values such as 514 or 66050, since userAccountControl can contain different combinations of flags.
After making the changes, run a test LDAP import with a known disabled AD account and check the import set to confirm the record is coming through. Then verify that the transform updates the existing sys_user record and sets active to false.
If you prefer not to include disabled accounts in your normal LDAP import, another option is to create a separate LDAP definition that only retrieves disabled users and use its transform map to deactivate them.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
Hi dpa20,
Are you integrating via standard LDAP/MID Server, or are you using Integration Hub (Azure AD Spoke / Okta Spoke)?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 weeks ago
Via Ldap/Mid server Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 weeks ago
The main thing I would check first is the LDAP filter. If disabled AD users are excluded from the LDAP query, ServiceNow never receives those records, so it cannot update the existing users to inactive.
Start by opening System LDAP, then LDAP Servers, and check the User OU Definition. Make sure the LDAP filter is not excluding disabled accounts. If you have a condition that filters out disabled users, remove it so those accounts are included in the import.
Next, confirm that userAccountControl is included in the attributes coming from AD. Then check the transform map and add the logic needed to set active to false when the disabled bit is present. I would use the disabled bit rather than checking only specific values such as 514 or 66050, since userAccountControl can contain different combinations of flags.
After making the changes, run a test LDAP import with a known disabled AD account and check the import set to confirm the record is coming through. Then verify that the transform updates the existing sys_user record and sets active to false.
If you prefer not to include disabled accounts in your normal LDAP import, another option is to create a separate LDAP definition that only retrieves disabled users and use its transform map to deactivate them.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
Hi @dpa20 ,
Could you please confirm if you are using LADP integration or spoke base integration ?
If it's LDAP integration please check the following steps:
Run an LDAP test query for a disabled AD user and confirm the record is returned.
Check the import set table in ServiceNow to see if the disabled flag is coming in.
Verify transform maps: ensure the AD disabled flag maps to active=false.
Review reconciliation rules: confirm AD has priority over other sources.
Please mark helpful & correct answer if it's worthy for you.
