Create, delete, and manage objects in Microsoft Active Directory, such as users, groups, and computers.

Integration Hub subscription

This spoke requires an Integration Hub subscription. For more information, see Legal schedules - IntegrationHub overview.

Important:
  • Starting with the Vancouver release, Microsoft Active Directory Spoke is being prepared for future deprecation. It is hidden and no longer activated on new instances but will continue to be supported. Microsoft Active Directory v2 Spoke provides the latest experience for this functionality. For details, see the Deprecation Process [KB0867184] article in the Now Support Knowledge Base.
  • This spoke is available as part of the family release. This spoke can be used to handle the computer objects.

Spoke requirements

Confirm that the Active Directory web services (ADWS) is deployed on the server that has Microsoft AD installed. For information on deploying ADWS, see https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/configure-the-active-directory-web-services-adws-to-start-automatically-on-all-servers for information about deploying ADWS.

Since your instance must have a MID Server set up and configured to use the PowerShell, the MID Server must be able to access the ADWS at port 9389.

In the MID Server and Microsoft AD server, run these PowerShell commands to install the Active Directory module:
PS> Import-Module ServerManager
PS> Install-WindowsFeature -Name RSAT-AD-PowerShell

Spoke flows

The Microsoft Active Directory spoke provides sample flows in the draft state to demonstrate automating Active Directory tasks. To customize a sample flow, copy it to a new application scope. Available sample flows include:

Flow Description
User Offboarding Disables an AD user account and removes the user from any AD groups when a ServiceNow user record is deactivated.
User Onboarding Creates and enables an AD user account when a ServiceNow user record is activated.

Spoke subflows

This spoke has no sample subflows.

Spoke actions

The Microsoft AD spoke provides actions to automate Microsoft Active Directory tasks when events occur in the ServiceNow AI Platform. Available actions include:

Category Action Description
Computer Management Create Computer Creates a Computer Account in Active Directory.
Delete Computer Deletes a computer from Active Directory.
Disable Computer Disables a computer account in Active Directory.
Enable Computer Enables a computer account in Active Directory.
Get Computer OU Gets the Organizational Unit (OU) of a Computer Account.
Is Computer Enabled Checks the status of the specified computer account in Active Directory.
Move Computer to OU Changes the Organizational Unit (OU) of a Computer Account in Active Directory.
Group Management Add User To Group Adds an existing Active Directory user to an Active Directory group.
Create Group Creates a group in Active Directory.
Delete Group Deletes a group from Active Directory.
Lookup Group Gets the details of a given group in Active Directory, including the group category, scope, and distinguished name.
Remove User From Group Removes an existing user from a group in Active Directory.
Password Management Change User Password Changes the user password in AD. The password input must comply with Active Directory password requirements.
Is User Account Locked Checks the locked status of the specified user account in Active Directory.
Reset AD User Password Resets a user's password in Active Directory.
User Management Create User Creates a user with no password in Active Directory. To enable a user to set a password, log in to AD, create a default password for the user, and enable password reset.
Delete User Deletes a user from Active Directory.
Disable User Disables a user account in Active Directory.
Enable User Enables a user account in Active Directory.
Is User Enabled Checks the status of a user account in Active Directory.
Is User In Group Checks if an existing Active Directory user is a member of an Active Directory group.
Lookup User Gets the details of a given user in Active Directory.
Unlock AD Account Unlocks a user account in Active Directory.
Update User Updates user attributes in Active Directory.
Update User Home Location Updates the Home Directory for a User in Active Directory.
Object Management Create AD Object Creates an object of any type supported in Active Directory.
Delete AD Object Deletes an object of any type from Active Directory.
Query AD Queries AD for objects specified by a search filter.
Update AD Object OU Changes the Organizational Unit (OU) of an object in Active Directory.
Update AD Object Expiration Update the account expiration date of an object in Active Directory.

MID Server requirements

To use these actions, your instance must have a MID Server set up and configured to use the PowerShell. For more information about running actions on the MID Server, see Integration steps. For information, see MID Server.

Note: MID and Microsoft Active Directory must be installed on different servers.

Connection and credential alias requirements

Integration Hub uses aliases to manage connection and credential information, and OAuth credentials. Using an alias eliminates the need to configure multiple credentials and connection information profiles when using multiple environments. If the connection or credential information changes, you don't need to update any actions that use the connection.

This spoke uses the AD alias record to authorize actions in Microsoft Active Directory.

Connection alias Description Connection URL
AD Connection to Microsoft Active Directory. The URL of the host machine where Microsoft Active Directory is installed.

For information about setting up the spoke, see Set up Microsoft Active Directory spoke.