AD orchestration using SID

​@DanielRuff  not sure if you use local ad but I had to start somewhere :) 

​@Medic1334 

I had a few customers run into this issue when their SAMAccountName did not match the part of their email address before the "@" symbol. Because of that, we moved away from this logic and switched to "Get User by Email", using the SID for any follow-up automation instead. I'm not sure whether this action was only available in Entra ID or if it was also available in on-premises Active Directory.

I hope I'm not mixing up any of the terminology, as I'm not very familiar with all the AD concepts such as UPN, sAMAccountName, and similar attributes.

For a few automations, you need to use PowerShell instead of the built-in AD orchestration activities. For example, when we created an automation to set the "Change password at next logon" flag, that option was not available in the local AD orchestration activities when I last worked on a similar automation a few years ago.

Hope that helps.

Thanks, I wasn’t clear in my idea, it’s about when you synchronize users from local AD to Firstservice. 

Unfortunately, I can’t help much with that particular use case. The default synchronization using the Network Discovery Probe has always worked reliably for us, so we haven’t had to implement an alternative approach.

I’m just fishing for votes ;) 

Perhaps you create a requester forget that mirrors your user deletion from AD? This will ensure the user is always up to date.

AD sync should deactivate user when suspended from AD which should also prevent showing up in searches and assignment of inventory.

The Server do not delete/forget requesters. So, if the customer deletes the user and later a new user with same SAMAccount and e-mail comes in the server will just update the requester in FS.

Should be easy enough to run a powershell script. I believe you are on an MSP, so if you could get their active directory team to give you an export of deleted users before they pull the trigger, then you could run it against that list. 

Or generate a integrations user for the org that has their AD syncing in and create a quick powershell API interaction script that they can run before they delete out of AD.

Of course there are some security challenges with doing this, but it would be an option to help you guys out. The last couple of times I've asked Chet gpt to do things for me. I had zero problems with the script as a whole, but I've also used it for a ton so it might be more tuned for me than others 🙂