How to trigger Script_To_Execute in WinPS connection?

[jralexander137]

Hi! I am trying to configure the winps connection to run some enable mailbox  commands as shown in the screenshot. How do I actually trigger this though? Not sure how to get a task created for prov job to process. Which action option in a user update rule do I use? Or do I need to use the createAccountJson instead or something else?

Thanks!

[adarshk]

Hi @jralexander137 

You can leverage the existing action blocks and call the respective scripts.
You can leverage the Creating a Connection section from the below document for setting up connection parameter.

https://docs.saviyntcloud.com/bundle/WinPS-v23x/page/Content/Understanding_the_Integration-between-E...

[jralexander137]

So I have the connection configured and test connection works. But how do i configure an update rule to actually call the SCRIPT_TO_EXECUTE? I don't need to create accounts or anything, just run a couple PS commands to enable mailboxes.

[jralexander137]

I've reviewed that documentation already but did not see anything that would answer my questions. I have SCRIPT_TO_EXECUTE populated with the script to run. I don't an appropriate action in the user update rules to trigger that SCRIPT_TO_EXECUTE though. Do I need to configure the createAccountJson with my script instead? Or is there some other action option to select?

[adarshk]

For example:

If you want to enable an account you can call the respective script from the ENABLEACCOUNTJSON block.

This call can be triggered through rules.

Thanks,
Adarsh Kulkarni

[jralexander137]

So I should be using one of the create/enable/disable/update JSON configs instead of the SCRIPT_To_Execute? In this case likely enable config.

[jralexander137]

So I guess I don't understand what the script_to_execute json is used for then nor how its triggered? I should be using say enable in this instance? 

[jralexander137]

Does this config look correct for enableaccountjson? {
"ENABLEACC": [
"Script=Enable-RemoteMailbox -Identity '${account.accountID}' -RemoteRoutingAddress '${user.systemusername}@blah.mail.onmicrosoft.com'", "Script=Enable-RemoteMailbox -Identity '${user.systemusername}' -Archive"
]
}

Or Do I need to list multiple commands differently?

[rushikeshvartak]

You can try putting the powershell script under WINCONNECTOR,
"SCRIPT_TO_EXECUTE_JSON"

[ "Script=\$pw = convertto-securestring 'password1234' -asplaintext -force;\$mycred = new-object -typename System.Management.Automation.PSCredential -argumentlist 'khalid.akhter',\$pw;Invoke-Command -ComputerName 'saviyntdc01' -Credential \$mycred -ScriptBlock {Get-WmiObject -Class Win32_UserAccount | select -First 100}"]

https://forums.saviynt.com/t5/identity-governance/exchange-reconciliation-using-win-ps-connector/m-p...

[jralexander137]

I guess I don't understand what Script_To_Execute is being used for nor how to actually trigger it. Is that code just executed during import? I am not trying to create accounts, recon users/accounts. I jsut want to run a couple enable-remote mailbox commands on new AD accounts that are being provisioned via an AD connection. Its sounding like I just need to put the config into enable account json and write a user update rule to enable the account(that does not exist in winps but in AD). I don't see any option in the user update rule actions list that will trigger the code in Script_To_Execute json. Is that a fair assumption?

[rushikeshvartak]

Script_To_Execute  is called during import to fetch data using command provided. You can' trigger same user update rule as its import.

[jralexander137]

Ok, got it, that part is clear now. So I will need to put the code in say EnableAccountJson to trigger it via user update rule.

[rushikeshvartak]

First you need to create application import data further you can enable mailbox.

[jralexander137]

Not sure I follow. Why do I need to create the configs to import accounts if there are no accounts to import? They will all just exist in AD on prem.

[rushikeshvartak]

If you don't have account then on which data you will trigger enable account json from win connector ?

[jralexander137]

Am I not able to just call the enable account json even if there is no associated account? The systemusername on the user record would be passed to these scripts so I don't actually need any account related values. Will that not work how I think? If not, I am not seeing how I can just use the connector to run some PS commands. I don't want to import any accounts or create anything like that.

[rushikeshvartak]

You need account to process tasks.

You can refer documentation on detailed on how to import.

[jralexander137]

Ok so, it looks like there is no way to just have the connector execute some PS commands or trigger a script remotely without either creating an account or having an account associated with this connection/endpoint?

There are no accounts to manage unless the expectation is to import all the on prem AD accounts using this connector as well to then be able perform any operations?

[rushikeshvartak]

yes u need account and on prem data