Active Directory Synchronization

Question

Hi Team,

I have configured active directory synchronization in D1IM and imported all the user accounts from AD to D1IM.. I see an option in the manager tool to manually link the AD accounts to the Q1IM employee records, and I could successfully link the accounts manually. However I am looking for an automated script to perform the linking. Has anyone come across the script?

Thanks,

Priya

priyadarshm · Accepted Answer

Hi Steffen, On changing the employee assignment criteria to PersonnelNumber = employeeID from centraluser account = samaccoutname, I executed the synchronization.. I observe that the fields Employee, and Managed Level in the user account information in Manager tool have disappeared.. Has the employee assignment criteria got anything to do with this? Thanks, Priya

Steffen.Einert · Answer

Hi Priya, for this purpose we have the script "VI_PersonAuto_ADS". Normally this script will be executed automatically by different processes, example: "VI_ADS/EX2K_ADSAccount_Insert/Update (Fullsync)". This process runs everytime when a new AD account was created/updated during a sync. The 1st step of this process ("Search and Create Person for Account (Fullsync)") executes the mentioned script and searches/creates a person for this account and assigns the person with the account. The behavior depends on the config parm "TargetSystem\ADS\PersonAutoFullSync". I hope these information points you in the right direction. Best regards, Steffen

Steffen.Einert · Answer

Hi Priya, that's dangerous. The primary object in Q1IM is the person. Unmanaged accounts doesn't get any properties from the linked person. Full managed accounts gets a lot of properties from the person. When you change the managelevel from 0 to 1 the account will be changed in nearly every case. You could get changes like these: - change of the login name - change of the location of the home directory - change of the properties for the remote access - ... That's why it's not recommended to change EXISTING accounts from unmanaged to full managed automatically via a process. You can do this manually - in this case you have an overview of the changes. Normally the exisiting accounts stay on "unmanaged" and only new created accounts (by processes in Q1IM) will be "full managed". So far the suggestions. Now I come to the information how you could do it even so. As I told you the creation/assignement of the persons will be done by the script "VI_PersonAuto_ADS". This script is an overrideable script. That means you can write a custom script (as overrides script) with the same code for now. This code can be modified to implement the needed changes. For instance you can modifiy this line in the script to use another manage level for the account: Acc("ManageLevel").NewValue = 0 But I wouldn't do it ... Best regards, Steffen