Active Directory management & automation

Move Newly Created Users to a Specific OU

Adaxes allows you to automatically move Active Directory objects to specific OUs or containers when an object is created, modified, disabled, etc. In this tutorial, you will learn how to configure Adaxes to automatically move newly created users to a specific OU based on the user's city.

To automatically move new users to a specific AD location, you need to create a Business Rule that will be executed after a new user account is created in Active Directory.

1Launch Adaxes Administration Console, right-click your Adaxes service, point to New and click Business Rule . The Create Business Rule wizard will open.

Launching the Create Business Rule wizard

2Enter the name for the new Business Rule and click Next.

3Here you need to specify when the new Business Rule must be executed. As you need to move user accounts after their creation, do the following:

  • Select User in the Object Type list.
  • Select After in the Operation section.
  • Select Creating a User in the Operation section and click Next.

Selecting the triggering operation for the Business Rule

4 Now, you need to create an action that will move newly created users to an Organizational Unit. To do this:

  • Click the Add Action link.
  • In the dialog that opens, select the Move the User action.
  • In the Action Parameters section, click Select Location.

    Adding Add to Group action

  • Select an Organizational Unit that corresponds to one of the cities.

  • Click OK

5 To move users to the specified OU only if their office is located in a specific city, you need to add a condition:

  • Right-click the Move the User action and click the Add Condition icon.

  • In the dialog that opens, select the If <property> <relation> <value> condition type.
  • In the Condition Parameters section specify City equals New York, and click OK.

    Adding Business Rule condition

To make sure that the city is always specified for newly created users and the city name is spelled correctly, you can use Property Patterns. A Property Pattern called User Pattern is applied to user accounts by default. To update it:
  • In Adaxes Administration Console, navigate to <Your Adaxes Service> \ Configuration \ Property Patterns \ Builtin and select User Pattern.
  • Add a Property Pattern item for the City property.
  • Select the The property is required option.
  • Specify the names of cities in the Must be one of the following values only field.
  • Optionally, set the default city in the Generate default value field.

6 Now, you need to add actions and conditions for other cities. For this purpose, click the Add action to a new set link and repeat steps 4 and 5 for each city.

Adding additional actions and conditions

Using Templates to Specify Organizational Units

Alternatively, you can configure a single action suitable for all the Organizational Units. Thus, you will avoid the need to create multiple actions or update the Business Rule in the future. In this case, instead of picking a specific Organizational Unit, you need to specify a template that defines the relationship between the user's city and the OU. For example, using a template, you can move a user to an OU named the same as their city.

Specifying a template

A template is used to build the Distinguished Name (DN) of an Organizational Unit. To include properties of the new user in the DN, use value references (e.g. %department% or %l%). When the action is executed, the value references are substituted with property values of the user account. For example, if you specify %l%, this value reference is replaced with the name of the city specified for the user in Active Directory.

To be able to specify a template, on the Select Location dialog, activate the Template tab.

Examples

  • OU=%l%,%adm-ParentDomainDN% - The %l% value reference will be substituted with the name of the user's city specified in AD, and the %adm-ParentDomainDN% value reference will be substituted with the Distinguished Name of the AD domain of the user. Thus, for example, a user whose city is New York created in domain example.com will be moved to the following OU:
    OU=New York,DC=example,DC=com.
  • OU=Customer Accounts,OU=%l%,DC=%company%,DC=com - The %l% value reference will be substituted with the name of the user's city specified in AD, and the %company% value reference will be substituted with the name of the user's company. Thus, for example, if you create a user whose city is Los Angeles and company is Acme, they will be moved to the following Organizational Unit:
    OU=Customer Accounts,OU=Los Angeles,DC=acme,DC=com.
  • OU=%employeeType%s,OU=%department%,DC=example,DC=com - The %employeeType% value reference will be substituted with the employee type specified for the user in Active Directory, and the %department% value reference will be substituted with the name of the user's department. Thus, for example, if you create a user whose employee type is Temporary Hire and department is Transportation, they will be moved to the following Organizational Unit:
    OU=Temporary Hires,OU=Transportation,DC=example,DC=com.

When finished, click Next.

7 Here, at the Activity Scope page you need to specify where in Active Directory a user must be created to trigger this Business Rule. Click Add.

Specifying rule activity scope

8 In the Business Rule Activity Scope dialog that opens, you need to specify the Active Directory locations where the Business Rule will be effective. Select one of the following items:

  • All Objects - select if you want this Business Rule to be executed when a user is created in any AD domain managed by the Adaxes service.

  • Specific Domain - select if you want this Business Rule to be executed when a user is created in the AD domain you specify.

  • OU or Container - select if you want this Business Rule to be executed only when a new user is created under the selected OU or container.

Select the item you need and click Add. When finished, click OK.

9 The specified activity scope items will be displayed in the Assignments list. Click Finish.

Now, when the Business Rule is complete, every time a new user is created in AD (no matter in which way - using Administration Console, Web Interface, during data import, via PowerShell scripts, etc.), Adaxes will automatically move this user to the OU you specify.

Move Users after Creation, Modification and by Schedule

If your Active Directory object location policies depend on user account properties or on the user group membership, you may also need to move users between OUs after a user is updated or added/removed from a group.

For this purpose, you need to create a Custom Command that will move users according to certain rules, and then execute this Custom Command by Business Rules and Scheduled Tasks.

Create a Custom Command that will move users to the specific locations.
For details on how to create Custom Commands, see Create a Custom Command.

Custom Command for Users Moving

Disable the Custom Command if you don't want to execute it manually.

Create a Business Rule that will be executed after creation of new users in Active Directory. Add an action to this Business Rule that will execute the command created on the step 1.

Active Directory Automation: After User Creation


Create a Business Rule that will be executed after updating users and add the Execute Custom Command action to this Business Rule.

Active Directory Automation: After User Update


Create a Business Rule that will be executed after adding or removing members from a group. Add the Execute Custom Command action to this Business Rule to execute your command.

Active Directory Automation: After Add/Remove Group Members


Create a Scheduled Task that will periodically execute your Custom Command. This will allow you to automatically move users that are modified or added/removed from groups outside Adaxes.

Active Directory Automation: Scheduled Task

For details on how to create Scheduled Tasks, see Schedule Tasks for Active Directory Management.
? Waiting

Progress status: Checking...