Create AD account specific OU

The way I have handled this in the past is to assign my custom form an identifier of some kind which you can configure into the advanced properties.  That identifier is passed with the $Request payload as a Control which you can read back from a policy script (OnPreCreateHandler) via $Request.GetInControl.  If the $Request is seen to be coming from your special form, your policy script can re-direct the object creation by assigning a new parent container by way of $Request.ChangeParentDN($MyNewContainer)

Thanks Johnny. I like the sound of this but i may need a bit more info in how to archive this. Are there any examples?

Am i looking in the right place under Extended Controls? If so can the control name be anything i like? What would a suitable control value be for this?

function OnPreCreate ($Request)
{

If ($Request.class -ne 'User'){Return}

# 'SVCACCTFORM' is a sample identifier set on the advanced properties of the form
# as the contents of the USERFORMTYPE control

Try
{

# USERFORMTYPE is an arbitrary name for the control - name can be pretty much anything as long
# as it doesn't conflict with an existing built-in Control

$CreationForm = $Request.GetInControl("USERFORMTYPE") # USERFORMTYPE is an arbitrary name for the control
}
Catch
{} # Need this in case there is no control - code aborts when you try to fetch an empty Control

# Quit if we didn't receive a control

If (!$CreationForm){return}

$MyNewContainer = "OU=Service_Accounts,DC=MyDomain,DC=Com"

# Redirect the request to where we want the service account created

$Request.ChangeParentDN($MyNewContainer)


}

Thanks Johnny. Going to go over this now. really appreciate your help

Hi. Just trying to understand this. 

Is  USERFORMTYPE the Extended Control Name? Am i missing something in the above script for grabbing the Value?

Just as an example my Control name is ServiceAccount and the Control Value is NewServiceAccount

Yes USERFORMTYPE is the control name (see line 12 of the script) and in my case, SVCACCTFORM is the value.

The value of the Control in this case doesn't really matter - the point is that it has a value assigned in the Web UI config.

Ah thank you it was SVCACCTFORM that was throwing me for a moment

How do i get it to pick up the policy settings applied to the OU?

That should just happen in the course of the creation of the account?

maybe its not quite working. When i open the form in the OU where the policy is applied then the First Name attribute is pre-populated with svc_ which is a PGV i have set. When i open the form from any other location with the above code in placed then that attribute is not populated 

That makes sense because the "context" of the policies is based on where you are starting from.

However, once the object actually gets created in the "right" place, the policies linked to that location should take precedence.

The way I dealt with this problem for several clients is that I created a virtual attribute for OUs called (for example) IsSvcAcctOU.

I created a custom "New Service Account" right pane command (associated with OUs under "Objects" under customization)  which only lights up if the IsSvcAcctOU."flag" VA is TRUE for the current context / OU. I hope that make sense.

That makes sense because the "context" of the policies is based on where you are starting from.

However, once the object actually gets created in the "right" place, the policies linked to that location should take precedence.

The way I dealt with this problem for several clients is that I created a virtual attribute for OUs called (for example) IsSvcAcctOU.

I created a custom "New Service Account" right pane command (associated with OUs under "Objects" under customization)  which only lights up if the IsSvcAcctOU."flag" VA is TRUE for the current context / OU. I hope that make sense.

Does that allow the policy to kick in if your not creating in the OU where the policy is applied? 

No - the point is that you are basically forced to do your create only in designated locations since the custom New Service Account command would only be visible when you are "sitting" in a correct OU that has the VA set to TRUE.

Ok, see what your saying now. I guess i was trying to have it so people didn't need to worry where to create and it would be taken care of in the background. I think the OU VA might be a good way to go anyway 

The OU VA is a nice touch. I think i can work with that. Thanks Johnny. really appreciate your help