Send E-mail on Adding Members to Specific Groups
With the help of Adaxes, it is possible to automatically send e-mail notifications of any operation performed in Active Directory. In this tutorial, you will learn how to configure Adaxes to automatically send an e-mail when a new member is added to specific Active Directory groups. This is useful, for example, if you need to control the group membership of critical Active Directory groups.
To send e-mail notifications about new group members, you need to create a Business Rule that will be automatically executed after a member is added to an AD group.
Launch Adaxes Administration Console, right-click your Adaxes service, point to New and click Business Rule. The Create Business Rule wizard will open.
Enter the name for the new Business Rule and click Next.
Here you need to specify when the new Business Rule must be executed. As we want to send notifications after a member is added to a group, do the following:
- Select Group in the Object Type list.
- Select After in the Operation section.
- Select Adding a member to a Group in the Operation section and click Next.
Since the Business Rule will send e-mail notifications, at this step you need to add the Send e-mail notification action to the Business Rule. Click the Add Action link and select the Send e-mail notification action.
Customize the e-mail notification template in the lower part of the Add Action dialog.
In the To field, specify semicolon-separated e-mail addresses of the notification
recipients. To send this notification to all members of the group, to which a new
member is added, provided that this group has an e-mail address established, you
can use value reference %mail%. This value reference
will be replaced with the e-mail address of the group.
Click the button located to the right to select notification recipients in Active Directory.
- In the Subject field, specify a subject for the notification.
- In the Message field, specify the notification message text. To send notifications in HTML format, select HTML in the drop-down list located to the right of the Message field. To edit the message text in a visual HTML editor, click the HTML Editor button.
Group Name: %name%
New Member: %member%
After replacing value references, the notification text will be as follows:
Group Name: Enterprise Admins
New Member: CN=John Doe,CN=Users,DC=example,DC=com
Add 'Oliver Brune (example.com\HR Department)' to 'EMEA Group (example.com\HR Department)'.
When finished, click OK.
Optionally, you may want the Business Rule to send e-mail notifications, only if certain conditions are met. For example, to send notifications, only if the user who performed the operation is not a member of a specific AD group, do the following:
- Select the action/condition set (click the created action to highlight the set) and click the Add Condition icon.
- In the Add Condition dialog, select the If the initiator is a member of <Group> condition type.
- Select is not in the drop-down list located in the Condition Parameters section.
- Click the Select Group button and select the group you need.
- Click OK.
Templates provide additional possibilities when used in conditions. For example, using a template, you can check whether the user who performs the operation and the target group are located in the same Organizational Unit or whether the user is the owner of the group.
Specifying a template
When specifying a template, first, you need to select a type of the condition where the template will be used, and then specify the template. For example, in order to check whether the user who performs the operation and the target group are located in the same OU, you need to use the If located under <location> condition, and specify the following template for location: %adm-InitiatorParentDN%.
To specify a template:
- In the Add Condition dialog, select the condition type you need.
- Click the Select <Object> button corresponding to the condition type
you selected. For example, if you selected the If located under
<location> type, click Select Location.
- Activate the Template tab.
The condition is met if the user who performs the operation is located in the same Organizational Unit as the group
Template: If located under %adm-InitiatorParentDN%.
When the condition is checked, the %adm-InitiatorParentDN% value reference is substituted with the DN of the OU that hosts the user who perofrms the operation. In other words, the condition checks whether the Distinguished Names of the OU where the group is located and the OU where the user is located are the same.
The condition is met if the user who performs the operation is the group owner
Template: If the initiator is %managedBy%.
When the condition is checked, the %managedBy% value reference is substituted with the DN of the group owner specified in the Managed By property of the group. Thus, the condition checks whether the operation initiator is the user specified in the property.
The condition is met if the user is a member of the group
Template: If the initiator is a member of %distinguishedName%.
When the condition is checked, the %distinguishedName% value reference is substituted with the Distinguished Name of the group. Thus, the condition checks whether the user is a member of the group on which the operation is performed.
When finished, click Next.
Here, at the Activity Scope page you need to specify, for which AD groups the Business Rule will send notifications. Click Add.
In the Business Rule Activity Scope dialog that opens, select one of the following items:
All Objects - select if you want this Business Rule to send a notification,
if a member is added to any group located in any AD domain managed by the Adaxes
Specific Domain - select if you want this Business Rule to send a notification,
if a member is added to any group located in the AD domain you specify.
OU or Container - select if you want this Business Rule to send a notification,
if a member is added to any group located under the selected OU or container.
- Group - select a specific group, if you want this Business Rule to send a notification, if a member is added either to this group or to a group that is a member of this group. Once selected, you will need to specify the assignment scope in the Assignment Options dialog.
- Business Unit - select a Business Unit, if you want this Business Rule to send a notification, if a member is added to a group that is a member of the selected Business Unit. To view available Business Units, select the Business Units item in the Look in drop-down list.
Select the item you need and click Add. When finished, click OK.
The specified activity scope items will be displayed in the Assignments list. Click Finish.
Now, when the Business Rule is complete, every time a member is added to a certain AD group (no matter in which way - using Administration Console, Web Interface, via PowerShell scripts, etc.), Adaxes will automatically send a notification to the specified recipients.
Configuring Adaxes Service to Send E-Mail Notifications
To enable Adaxes to send e-mail notifications, you need to configure the outgoing mail settings for your Adaxes service:
- Right-click your Adaxes service and click Properties in the context menu.
- Click the Mail Settings tab and change the SMTP settings.