Active Directory management & automation

Send E-mail on Adding Members to Specific Groups

With the help of Adaxes, it is possible to automatically send e-mail notifications of any operation performed in Active Directory. In this tutorial, you will learn how to configure Adaxes to automatically send an e-mail when a new member is added to specific Active Directory groups. This is useful, for example, if you need to control the group membership of critical Active Directory groups.

To send e-mail notifications about new group members, you need to create a Business Rule that will be automatically executed after a member is added to an AD group.

1Launch Adaxes Administration Console, right-click your Adaxes service, point to New and click Business Rule. The Create Business Rule wizard will open.

2Enter the name for the new Business Rule and click Next.

3Here you need to specify when the new Business Rule must be executed. As we want to send notifications after a member is added to a group, do the following:

  • Select Group in the Object Type list.
  • Select After in the Operation section.
  • Select Adding a member to a Group in the Operation section and click Next.

4 Since the Business Rule will send e-mail notifications, at this step you need to add the Send e-mail notification action to the Business Rule. Click the Add Action link and select the Send e-mail notification action.

5 Customize the e-mail notification template in the lower part of the Add Action dialog.

  • In the To field, specify semicolon-separated e-mail addresses of the notification recipients. To send this notification to all members of the group, to which a new member is added, provided that this group has an e-mail address established, you can use value reference %mail%. This value reference will be replaced with the e-mail address of the group.
    Click the button located to the right to select notification recipients in Active Directory.
  • In the Subject field, specify a subject for the notification.
  • In the Message field, specify the notification message text. To send notifications in HTML format, select HTML in the drop-down list located to the right of the Message field. To edit the message text in a visual HTML editor, click the HTML Editor button.
If you want the notification to include information about the group, to which a new member is added, you can use value references (e.g. %name%). Before sending a notification, Adaxes will replace these value references with the property values of this group. To include the logon name of the user who added a new member to the group, you can use value reference %initiator%. For example, you can enter the following notification text:
Group Name: %name%
New Member: %member%
Initiator: %initiator%
After replacing value references, the notification text will be as follows:
Group Name: Enterprise Admins
New Member: CN=John Doe,CN=Users,DC=example,DC=com
Initiator: aaron.dorben@example.com
If you want the e-mail notification to include the description of the operation that triggered the Business Rule, you need to insert value reference %adm-OperationDescription% into the text of the notification. Before sending a notification, Adaxes will replace this value references with the operation description. For example, if user Oliver Brune is added to group EMEA Group, %adm-OperationDescription% will be replaced with the following text:

Add 'Oliver Brune (example.com\HR Department)' to 'EMEA Group (example.com\HR Department)'.

When finished, click OK.

6 Optionally, you may want the Business Rule to send e-mail notifications, only if certain conditions are met. For example, to send notifications, only if the user who performed the operation is not a member of a specific AD group, do the following:

  • Select the action/condition set (click the created action to highlight the set) and click the Add Condition icon.
  • In the Add Condition dialog, select the If the initiator is a member of <Group> condition type.
  • Select is not in the drop-down list located in the Condition Parameters section.
  • Click the Select Group button and select the group you need.
  • Click OK.

Using Templates in Conditions

Templates provide additional possibilities when used in conditions. For example, using a template, you can check whether the user who performs the operation and the target group are located in the same Organizational Unit or whether the user is the owner of the group.

Specifying a template

When specifying a template, first, you need to select a type of the condition where the template will be used, and then specify the template. For example, in order to check whether the user who performs the operation and the target group are located in the same OU, you need to use the If located under <location> condition, and specify the following template for location: %adm-InitiatorParentDN%.

To specify a template:

  • In the Add Condition dialog, select the condition type you need.
  • Click the Select <Object> button corresponding to the condition type you selected. For example, if you selected the If located under <location> type, click Select Location.

  • Activate the Template tab.

Examples

The condition is met if the user who performs the operation is located in the same Organizational Unit as the group

Template: If located under %adm-InitiatorParentDN%.

When the condition is checked, the %adm-InitiatorParentDN% value reference is substituted with the DN of the OU that hosts the user who perofrms the operation. In other words, the condition checks whether the Distinguished Names of the OU where the group is located and the OU where the user is located are the same.

The condition is met if the user who performs the operation is the group owner

Template: If the initiator is %managedBy%.

When the condition is checked, the %managedBy% value reference is substituted with the DN of the group owner specified in the Managed By property of the group. Thus, the condition checks whether the operation initiator is the user specified in the property.

The condition is met if the user is a member of the group

Template: If the initiator is a member of %distinguishedName%.

When the condition is checked, the %distinguishedName% value reference is substituted with the Distinguished Name of the group. Thus, the condition checks whether the user is a member of the group on which the operation is performed.

When finished, click Next.

7 Here, at the Activity Scope page you need to specify, for which AD groups the Business Rule will send notifications. Click Add.

8 In the Business Rule Activity Scope dialog that opens, select one of the following items:

  • All Objects - select if you want this Business Rule to send a notification, if a member is added to any group located in any AD domain managed by the Adaxes service.

  • Specific Domain - select if you want this Business Rule to send a notification, if a member is added to any group located in the AD domain you specify.

  • OU or Container - select if you want this Business Rule to send a notification, if a member is added to any group located under the selected OU or container.

  • Group - select a specific group, if you want this Business Rule to send a notification, if a member is added either to this group or to a group that is a member of this group. Once selected, you will need to specify the assignment scope in the Assignment Options dialog.

    Assignment Options

    To send a notification if a member is added to the selected group only, select This Group object .

    To send a notification if a member is added to a group that is a member (direct or indirect) of the selected group, select Members of this Group.

    To send a notification if a member is added to a group that is a direct member of the selected group, select Direct members only.

  • Business Unit - select a Business Unit, if you want this Business Rule to send a notification, if a member is added to a group that is a member of the selected Business Unit. To view available Business Units, select the Business Units item in the Look in drop-down list.

Select the item you need and click Add. When finished, click OK.

9 The specified activity scope items will be displayed in the Assignments list. Click Finish.

Now, when the Business Rule is complete, every time a member is added to a certain AD group (no matter in which way - using Administration Console, Web Interface, via PowerShell scripts, etc.), Adaxes will automatically send a notification to the specified recipients.



Configuring Adaxes Service to Send E-Mail Notifications

To enable Adaxes to send e-mail notifications, you need to configure the outgoing mail settings for your Adaxes service:

  • Right-click your Adaxes service and click Properties in the context menu.
  • Click the Mail Settings tab and change the SMTP settings.

Specifying SMTP settings for Adaxes service

? Waiting

Progress status: Checking...