AD disable account with if else condition

[SumathiSomala]

Hi team ,

we have requirement for AD when user account is disabled account should move to different OUs as per condition.

user update rules are getting triggered disable account tasks are created.

when i run wsretry job, pending task is not moving.

but account is getting disabled in  AD.

Move user to OU not working.

DISABLEACCOUNTJSON:

{
"deleteAllGroups":"No",
"userAccountControl":"514",
"moveUsertoOU":"${if (user.customproperty40=='LOA'){'OU=LOA,OU=XX Users,DC=XX,DC=LOCAL'}else if(user.statuskey==0){'OU=Disable Accounts,OU=XX Users,DC=XX,DC=LOCAL'}else{'OU=On Hold User Accounts,OU=XX Users,DC=XX,DC=LOCAL'}}",
"password": "${randomPassword}"
}

Error in pending task:

Any help would be appreciated

.

[pmahalle]

Hi @SumathiSomala ,

Any reason you are passing password while disabling the account. Can you try removing it?

[rushikeshvartak]

LDAP Error Codes Document - https://docs.servicenow.com/en-US/bundle/vancouver-platform-security/page/administer/reference-pages...

LDAP: error code 80 - The password provided by the user did not match any password(s) stored in the user's entry Worker . 

{
"deleteAllGroups":"No",
"userAccountControl":"514",
"moveUsertoOU":"${if(user.customproperty40.equals('LOA')){'OU=LOA,OU=XXXX Users,DC=XXXX,DC=LOCAL'}else if(user.statuskey==0){'OU=Disable Accounts,OU=XXXX Users,DC=XXXX,DC=LOCAL'}else{'OU=On Hold User Accounts,OU=XXXX Users,DC=XXXX,DC=LOCAL'}}"
}

[SumathiSomala]

Thanks @pmahalle and @rushikeshvartak ,

Tried with and without passing password no luck.

Already we tested only else condition is working as expected.

when if or else if condition true move OU not working and pending tasks are stuck in queue.

Attaching the logs.

Any other inputs?

[rushikeshvartak]

{
  "deleteAllGroups": "No",
  "userAccountControl": "514",
  "moveUsertoOU": "${if (task?.userKey?.customproperty40=='LOA'){'OU=LOA,OU=XX Users,DC=XX,DC=LOCAL'}else if(task?.userKey?.statusKey==0){'OU=Disable Accounts,OU=XX Users,DC=XX,DC=LOCAL'}else{'OU=On Hold User Accounts,OU=XX Users,DC=XX,DC=LOCAL'}}"
}

[SumathiSomala]

Tried @rushikeshvartak 

No luck .

Account status is changed to 66048 in AD and move OU not working and pending tasks are stuck in queue.

[rushikeshvartak]

Does user have customproperty set ?

[SumathiSomala]

Yes @rushikeshvartak 

User update rule set  to disable account in AD and then set user customproperty 40 .

Disable account tasks created .

Ran the provisioning job 

User account disabled in AD and Move OU not happening and pending tasks stuck on Q.

Any idea?

[rushikeshvartak]

"moveUsertoOU":"${if(user.customproperty40.equalsIgnoreCase('LOA')){'OU=LOA,OU=XXXX Users,DC=XXXX,DC=LOCAL'}else if(user.statuskey==0){'OU=Disable Accounts,OU=XXXX Users,DC=XXXX,DC=LOCAL'}else{'OU=On Hold User Accounts,OU=XXXX Users,DC=XXXX,DC=LOCAL'}}"

[SumathiSomala]

Tried @rushikeshvartak ,

No luck this time account is also active in AD.

Also tried with different CP and value

Is there any other configurations/customization required to perfom disable account.

[rushikeshvartak]

user.customproperty40.equalsIgnoreCase('LOA')
? 'OU=LOA,OU=XXXX Users,DC=XXXX,DC=LOCAL'
: (user.statuskey == 0
? 'OU=Disable Accounts,OU=XXXX Users,DC=XXXX,DC=LOCAL'
: 'OU=On Hold User Accounts,OU=XXXX Users,DC=XXXX,DC=LOCAL')

[SumathiSomala]

@rushikeshvartak 

can u help with complete JSON

[SumathiSomala]

Tried @rushikeshvartak ,

Still luck.

Will raise fresh desk ticket

[ruqayyah]

@SumathiSomala 

Please try the below  json and let us know if that helps.

Regards

Ruqayyah

[SumathiSomala]

Thanks @ruqayyah 

Already tried not working

[SumathiSomala]

Hi team,

Any other inputs ?

still we are unable to perform moveusertoOU

[SumathiSomala · Accepted solution]

Thanks all tried all suggestion shared.it didn't work. So I have configured user update rule to disable the account and update AD account to move user to different OU.