Setting of Flags for AD Accounts

[varunpuri]

Hi,

There are 2 types of accounts to be created in Active Directory via Saviynt in our environment. One is Service Account and another is ADM Account.

For Service Accounts, the following flags need to be set - 

- user cannot change password

- password never expires

For ADM Accounts, the following flags need to be set - 

- user must change password at next logon

- Account is sensitive and cannot be delegated

How can we achieve this ?

Best Regards,
Varun

[dgandhi]

Hi @varunpuri 

Can you check below

For Service Accounts, the following flags need to be set -

- user cannot change password

pwdLastSet: Instruct the connector to change or retain your password the first time you log on to Active Directory. When set to 0, change your password the first time you log on to Active Directory.

- password never expires

accountExpires: Instruct the connector not to expire the account. When set to 0, the Active Directory account does not have an expiry date.

For ADM Accounts, the following flags need to be set -

- user must change password at next logon

pwdLastSet: Instruct the connector to change or retain your password the first time you log on to Active Directory. When set to 0, change your password the first time you log on to Active Directory.

- Account is sensitive and cannot be delegated

All sample and example , you should get from AD connector document

https://docs.saviyntcloud.com/bundle/AD-v23x/page/Content/Configuring-the-Integration-for-Provisioni...

Thanks