ARSS: DisableAccount as part of deprovisioning task

Is the Connection in the Sync Service connecting to AD through Active Roles? If so, the entire Deprovisioning process, including everything mentioned above, can be handled by an Active Roles Deprovisioning Policy. Disabling a user as part of the deprovision is a simple check box in the policy.

Unfortunately I believe you are correct Alex.  In the absence of an actual Active Roles server through which you would have access to the virtual property edsvaAccountDisabled, you will have to manipulate UAC directly

Richard.Lambert - I assume this is the same project Alex has been on for a bit - they are using ARSS by itself without AR.

Perhaps anyone has a script handy to disable user? I can do one via ADSI reaching to AD direct (or just flat simple using PS AD module), but was just wondering if it can be done using ARSS syntax. I consider it "cleaner" this way. Thanks!

In the absence of being able to flip that virtual attribute bit I mentioned, ADSI would be the quickest way to do this (performance wise).  I'm not aware of any disabling methods built into ARSS aside from the ability to initiate deprovisioning where the target system Connection is via an Active Roles Connector.

I was just thinking doing Forward Sync Rule PS script to uac attribute , reading $dstObj.("userAccountControl") then manipulating to pass 514 then write into the Target without breaking any other uac flags. I just hate dealing with hex but may still end up trying :) I'll pass my results here if I get anything working!

Maybe this is what you are trying to say, but, per this article, the only bit you want to manipulate is the '2' right?

If the 2 bit is "on", the account is disabled.  So grab whatever value is in the source UAC and add 2.

lol I had same page already opened. Yes I'll play with it to figure out proper syntax without affecting other flags. Thanks!!!

This worked well ;)

$Log = "D:\QUEST\ARSS\DeprovisionJobs.log"
$result = $null
if (-not (test-path $Log))
{
New-Item $Log
}
$result = $dstObj["userAccountControl"]
if ((($dstObj["userAccountControl"])[0] -band 2) -eq 0)
{
"`"$(Get-Date -Format G)`",`"$($dstObj["samaccountname"])`",`"DISABLING`"" | out-file $Log -Append
$result = $dstObj["userAccountControl"] + 2
}
$result