Skip to main content
Solved

Editing "logonHours" Attribute with AD Orchestration

  • January 25, 2024
  • 1 reply
  • 83 views
BortFrenzy
Top Contributor
Forum|alt.badge.img+2

I am working on an orchestration for when users go on leave that will block their logon by editing the “logonhours” attribute in AD to block logon.

I am able to edit other attributes in the custom_attributes field without an issue, but when I go to update logonhours, I get the following error in the screenshot below:

 

In case the picture doesn’t load for anyone, the error is:

The request is not supported At line:1 char:1 + Set-ADUser -Identity 'CN=Test User,OU=************************************************ ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (CN=Test User,OU...s,DC=*********************) [Set-ADUser], ADException + FullyQualifiedErrorId : ActiveDirectoryServer:50,Microsoft.ActiveDirectory.Management.Commands.SetADUser

 

Disabling the user is not an option as it will kick off other automation that will break other things in the domain including their IP phone setup.

 

Is this field not able to be updated through orchestration? Or is there something I am missing here? I have tested on more than just the test user with the same results.

Best answer by BortFrenzy

I did find a solution for this, just in case anyone else runs into this.

Using the PowerShell Orchestrator, to block login in AD, use the following payload:

net user {{SamAccountName}} /domain /time:

To re-enable login, the following payload can be used in PowerShell Orchestration:

net user {{SamAccountName}} /domain /time:all

Hope this helps someone!

View original
    Did this topic help you find an answer to your question?

    1 reply

    BortFrenzy
    Top Contributor
    Forum|alt.badge.img+2
    • BortFrenzy
    • Author
    • Top Contributor
    • 5 replies
    • Answer
    • February 5, 2024

    I did find a solution for this, just in case anyone else runs into this.

    Using the PowerShell Orchestrator, to block login in AD, use the following payload:

    net user {{SamAccountName}} /domain /time:

    To re-enable login, the following payload can be used in PowerShell Orchestration:

    net user {{SamAccountName}} /domain /time:all

    Hope this helps someone!

    Reply


    Most helpful members this week

    Terms of UsePrivacy Notice