This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

QARS Workflow New-QADUSER from CSV - Access is Denied

I am calling the script module below from a Workflow in order to create new accounts from a CSV.

When I run the workflow manually (right click and select 'Run') the result is 'Access id Denied'. However, if I run the script in the same user context from the QARS management shell it succeeds.

("Allow the Workflow to be run on demand" is selected).

Any ides on why it doesn't work from the QARS Workflow?

Script Module:

function CreateUserAccounts {$Accounts = Import-Csv -Path “C:\Workday-Test\Joiners.csv”
# connect-qadservice -service KTNAPAPP720 -proxy
$WorkflowInfo = Get-QARSWorkflowInstance -Workflow “CN=Workday Import Joiners,CN=Workday,CN=Workflow,CN=Policies,CN=Configuration” -TaskStatus Pending

$WorkflowID = $WorkflowInfo.ID

$i = 1

foreach ($Account in $Accounts) {
$UserID = $Account.logonname
$Domain = $Account.FQDomain
$UPN = $UserID + “@” + $Domain
$OU = $Account.ou
$Password = $
if ($Account.accountExpires -eq “”) {
$AccountExpires = $Null
else {
$accountExpires = $Account.accountExpires
$Description = $Account.description
$FirstName = $Account.givenName
$LastName = $
$displayName = $Lastname + “, ” + $FirstName
$i ++
try {
New-QADUser -name $UserID -SamAccountName $UserID -ParentContainer $OU -UserPrincipalName $UPN -UserPassword $Password -Description $Description -FirstName $FirstName -LastName $LastName -displayName $displayName -ObjectAttributes @{VaPso_MailboxType='Regular';VAPso_MsolAccountSku='KTGLBUC:ENTERPRISEPACK'} -ErrorAction Stop
Set-qaduser -identity $upn -usermustchangepassword $true -accountExpires $accountExpires
catch {
$str += “Error occurred while processing Line ” + $i + ” where logonname = ” + $UserID
$str += [System.Environment]::NewLine
$str += $_
$str += [System.Environment]::NewLine
$str += “———————————————————-“
$str += [System.Environment]::NewLine
[System.IO.File]::AppendAllText(“C:\Workday-Test\Logs\Joiners-Logs\UserImport_$WorkflowID.log”, $str)

  • Does the ARS service account have rights to the file location?

  • Yes, it has rights to the CSV file location.. The file location is local to the QARS server from where the console is being run. The account being used is in the local administrators group and running 'View Effective Access' over the folder containing the CSV indicates 'Full Control'.

  • This could be an authentication issue, or it could be an access issue.

    The Workflow will run under the security context of the Active Roles Service Account by default. This is the account that is actually running the Active Roles Administration Service - this may not be the account which is managing the Domain. You should check the Windows Services to be sure that you are verifying access for the correct account.

    Also try changing the security context of the Workflow. Click on the Workflow Options and Start Conditions | Configure and then "Run-as" options in the bottom right. Change the "When started on demand, the Workflow runs under" option to "The Account of the User who started the Workflow". Save it, and run it manually to see if you get a different result.

  • I have checked the 'effective rights' of the ARS service account over the target OU where the new user objects should be created. It has rights over everything except for all of the delete properties. From my understanding this should be sufficient since nothing is being deleted. e.g. it has the 'Create User Objects' right but it is denied the 'Delete User Objects' right. This should be sufficient.

    'Run as' is a good tip. I'll check that and update later.

  • I have just tried running it in the contexts of two other accounts.

    Account1 - a service account created for the purpose which is a member of our ARS Admins group

    Account2 - an admin account which is a member of our ARS Admins group and which is also a member of 'Domain Admins' and 'Administrators' in the ARS managed domain.

    Unfortunately, it also fails in the context of those two additional accounts.