Active Administrator 8.6.2 - User Guide

Provisioning Users

Provisioning Users

Provisioning involves creating user accounts, giving permissions, and changing accounts or privileges as necessary.

To provision users:

1	Click Provisioning | Provision Users.

2	Click Provision Users to configure your provisioning settings.

3	On the Choose template screen, select the template that defines the columns in the user data file, and click Next.

You can use the default template provided by Active Administrator that contains basic user account attributes or select a previously created custom template

If there is an issue with the template file you will be prompted to either load the default file or edit the template and try again. See Editing the Provisioning Template for file details.

4	On the Import data screen, browse to the .csv file that contains the user account data, select whether the source user data is separated by a comma, colon, semi-colon, pipe, or tab, and enter the number of header rows to be removed from the file.

The imported data will display in the preview pane. If the format meets your requirement, click Next to select the provisioning option. If not, edit the template or the csv file, re-import the csv file and review the data again.

5	On the Select options page, define how you want to provision users, then click Next to commit the changes.

▪	Select to create new users, update existing users, or both.

▫	If selecting to create new users, select to have new users enabled (if required), and choose the domain and container where the users will be located.

NOTE: Passwords are required to provision users as enabled.

▫	If updating existing users, you can choose to update their passwords.

6	On the Provision users screen, preview the changes that will be made to the Active Directory once the updates are committed. Select Stop Preview to stop loading user data once you are satisfied with the settings.

7	Select Back to edit the user provisioning settings if required or click Commit to apply the updates in Active Directory.

Once you commit the changes, the Active Directory Users container is searched to locate the specified SAMAccountName attribute specified in the template. If an associated user is not found, a new user is created; if the user is found, it is updated with the attributes in the imported csv file.

8	The preview pane will be updated with the progress as users are provisioned.

Editing the Provisioning Template

Editing the Provisioning Template

The provisioning template contains the user attributes that you want to manipulate. A default template is installed with Active Administrator that contains the following user attributes: Login Name, Display name, First name, Last name, and Initial password. However, if required, you can create a copy of this file and update as required to meet your specific needs.

NOTE: The following fields are required in the template: • SAMAccountName • Common name • Display name • Temporary password (to create new users in the enabled state only)

NOTE: The template only supports single-value strings.

To edit the template

1	Locate the UserProvisioningTemplate.json file found under MyDocuments\Quest Active Administrator\Provisioning\Templates.

2	This file is read-only. To edit the file, you must make a copy of it and update as needed. You can then select this file in the provisioning wizard.

By default, the file contain fields for:

▪	name: The name of the template.

▪	description: A description of the template.

▪	properties: An array of properties used for user provisioning.

Each property will consist of:

▪	name: The name of the property, corresponding to an Active Directory property for a user object.

▪	displayName: The name that will display on the top of the list view columns.

▪	inclusion: One of the following values:

▫	Mandatory: This column is shown in the list view and *must* have a value.

▫	Optional: This column is shown in the list view and its value may be null.

▫	Ignore: This column is not shown in the list view, nor used for provisioning.

3	Re-import the csv file, and click Refresh Template to review the data again. Once you are satisfied with the preview, commit the updates.

Example template file structure

{

"name": "User provisioning template",

"description": "The template for provisioning users.",

"properties": [

{

"name": "saMAccountName",

"displayName": "Login Name",

"inclusion": "mandatory"

},

{

"id": "cn",

"displayName": "Common Name",

"adPropertyName": "cn"

"inclusion": "mandatory"

},

{

"name": "displayName",

"displayName": "Display Name",

"inclusion": "mandatory"

},

{

"name": "givenName",

"displayName": "First Name",

"inclusion": "optional"

},

{

"name": "sn",

"displayName": "Last Name",

"inclusion": "optional"

},

{

"name": "initialPassword",

"displayName": "Initial Password",

"inclusion": "optional"

}

]

}

Deprovisioning Users

Deprovisioning Users

Deprovisioning users removes privileges or access from an account or deletes an account that is no longer required as a result of employee leaving a company or changing responsibilities within the organization. The ability to automate this process helps to quickly ensure these accounts are not left exposed to attacks and potentially inappropriate data access.

To deprovision a user account:

1	Click Provisioning | Deprovision Users.

2	Click Deprovision Users to configure your provisioning settings.

3	Select the users to deprovision. Begin by selecting the required domain, then specify the required users using one of the following methods:

Search through Active Directory or type a specific user and add and remove as required.

Import a list of users from a .csv file. Browse to the .csv file that contains the user account data, select whether the source user data is separated by a comma, colon, semi-colon, pipe, or tab, enter the number of header rows to be removed from the file, and identify which column contains the required SAM account.

Use the list of users that have been deemed inactive through the settings that have been configured through Active Administrator. See Managing inactive accounts.

4	Once you have selected the users, choose whether you want to Disable accounts or Delete accounts, and click Next.

5	On the Deprovision users screen, preview the changes that will be made to the Active Directory once the updates are committed. Select Stop Preview to stop loading user data once you are satisfied with the settings.

6	Select Back to edit the user deprovisioning settings if required or click Commit to apply the updates in Active Directory.

7	The preview pane will be updated with the progress as users are deprovisioned.

Viewing the provisioning and deprovisioning logs

Viewing the provisioning and deprovisioning logs

When you begin the provisioning or deprovisioning process, a log file that tracks your provisioning actions is created, stored on the server until purged, and available to view in the client for troubleshooting purposes. For ease of management, the name of each log file is prefaced with the type of action (provisioning or deprovisioning), a date and time stamp, and a unique ID.

Once the existing log file reaches the maximum size of 16MB, a new log file is created.

To view the stored log entries

1	Click Provisioning | View logs.

2	Expand Provisioning or Deprovisioning to view the associated logs.

3	Select the required log to view the log message details.