AD disable account with if else conditions

[esinam_g]

Hello Guys,

we have requirement for AD when user account is disabled account should move to different OUs as per condition

I set up differents rules as of when the account is disabled when the user to be moved to a specifique OU.

However it doesnt seem to working,Could please take a look at my DISABLEACCOUNTJSON and provide some help

Thank you.

I have also posted my userupdate rule.

{
"deleteAllGroups": "${if (user.customproperty1 == 'Retired' || user.customproperty1 == 'Terminated') {'Yes'} else {'No'}}",
"userAccountControl": "514",
"moveUsertoOU": "${if (user.customproperty1 == 'On Leave' && user.customproperty1Updated && user.customproperty3 == 'J+0') {'OU=Inactifs,OU=xxx,OU=IQ,DC=XXX,DC=XXX'} else if (task?.userKey?.statusKey == 0) {'OU=Disable Accounts,OU=xxx,OU=XXX,DC=XXX,DC=XXX'}}"
}

[SumathiSomala]

@esinam_g What error you are getting and share the error logs

[Manu269]

@esinam_g this is 1 sample i can share which I am using :

{
"userAccountControl": "514",
"deleteAllGroups": "No",
"extensionAttribute9": "${ if(user?.customproperty6.equals('Manager')) {'Y'} else {'N'} }",
${
if(user.customproperty38=='1')
'\"description\": \"Disabled by SSM due to LOA\",
\"moveUsertoOU\": \"ou=Disabled Accounts,ou=Special Accounts,DC=corp,DC=MyOrg,DC=net\"'
else if (user.statuskey==0)
'\"description\": \"Disabled by SSM due to employment termination\",
\"moveUsertoOU\": \"ou=Disabled Accounts,ou=Special Accounts,DC=corp,DC=MyOrg,DC=net\",
\"manager\": \"\",
\"extensionAttribute15\": \"1\",
\"extensionAttribute14\": \"'+user.enddate+'\"'
else
'\"description": "Dormant account disabled by SSM due to inactivity\"'
}
}

[esinam_g]

i used this code but i am still getting some error message.I can see where the error is

{
"userAccountControl":"514",
${
if ((user.customproperty1=="Terminated") OR (user.customproperty1=="Retired""))
'\"moveUsertoOU\":\"OU=Departs,OU=COMPTES-UTILISATEURS,OU=IQ,DC=xxx,DC=xxx\",\"deleteAllGroups\":\"Yes\"'
} else {
'\"moveUsertoOU\":\"OU=inactifs,OU=COMPTES-UTILISATEURS,OU=IQ,DC=xxx,DC=xxx\",\"deleteAllGroups\":\"No\"'
}
}

Here is the error message

Error while Delete operation for account-HWT in AD - Failed to parse template script (your template may contain an error or be trying to use expressions not currently supported): startup failed: SimpleTemplateScript81.groovy: 3: expecting anything but ''\n''; got it anyway @ line 3, column 200. teAllGroups\":\"Yes\"'} else { ^ 1 error Error while Delete operation for account-HWT in AD - Failed to parse template script (your template may contain an error or be trying to use expressions not currently supported): startup failed: SimpleTemplateScript204.groovy: 3: expecting anything but ''\n''; got it anyway @ line 3, column 200. teAllGroups\":\"Yes\"'} else { ^ 1 error

[rushikeshvartak]

{
"userAccountControl": "514",
"${
if ((user.customproperty1 == "Terminated") || (user.customproperty1 == "Retired"))
{
\"moveUsertoOU\":\"OU=Departs,OU=COMPTES-UTILISATEURS,OU=IQ,DC=xxx,DC=xxx\",
\"deleteAllGroups\":\"Yes\"
}
else
{
\"moveUsertoOU\":\"OU=inactifs,OU=COMPTES-UTILISATEURS,OU=IQ,DC=xxx,DC=xxx\",
\"deleteAllGroups\":\"No\"
}
}"
}

[esinam_g]

Iam getting another error after trying the code above.i have also attached the logs.

I am putting here the initial code that just disable the account and move it to a specified OU for the departed users.this code works fine.

Is there any other way to move LOA users to another ou without using the disable pre processing?

{
"deleteAllGroups": "Yes",
"moveUsertoOU": "OU=XXX,OU=COMPTES-UTILISATEURS,OU=XXX,DC=XXX,DC=XXX",
"userAccountControl": "514"
}

[rushikeshvartak]

Please elaborate use case