This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ITOperating Data UID_ADSContainer assigned based on Dynamic Role

Hola,

Ok so I have commandeered a custom property on the person to be a list item with (3) values:

  1. Employee
  2. Consultant
  3. AvisoryMember

I have created corresponding dynamic roles to match the above. Lets take employees as our example.

Couple of notes:

  1. Person records that have the value "Employee" in the custom property are appropriately assigned to the Dynamic Role called "Employees"

  2. Every employee gets: 

    • A standard user account definition (Works fine)
    • A standard Mailbox (Standard user account as required account def. works fine as well)

  3. The "Employee" dynamic role has IT Operating Data assigned against the Standard user Account Definition that should assign the OU of the ADSAccount based on the value.

    • Example: TSBAccountDef:Standard User Account (DOMAIN) - ADSAccount.UIDADSContainer
      • The selected OU is "Employees"

  4. The ADSAccount.UID_ADSContainer template is configured as follows:

    • '$FK(UID_Person).UID_Department$
      '$FK(UID_Person).UID_Locality$
      '$FK(UID_Person).UID_ProfitCenter$
      #If ORG Then
      '$FK(UID_Person).UID_Org$
      #End If
      If CBool(Connection.Variables.Get("FULLSYNC")) = False Then
      Select Case ($FK(UID_TSBBehavior).ITDataUsage:Int$)
      	Case 0:'do not get data from employee
      	Case -1:'fill property initially from the ITData of the employee
      		If Not $[IsLoaded]:Bool$ Then
      			Value = TSB_ITDataFromOrg($UID_Person$, $UID_TSBAccountDef$, Base.TableDef.Columns("UID_ADSContainer")) 
      		End If
      	Case 1:'update property depending on ITData of the employee
      		Value = TSB_ITDataFromOrg($UID_Person$, $UID_TSBAccountDef$, Base.TableDef.Columns("UID_ADSContainer"))
      	
      	End Select
      End If


The issue is that while the dynamic role assignments work great, the corresponding ADSAccount does not move into the OU. I presume that I am missing something as this seems to be a rather straight forward use case.

What am I doing wrong here?

Thanks!

  • I believe the obvious thing here is wrong. I m quoting from the online manuals here:

    An employee is assigned to one primary location, one primary department, one primary cost center or one primary business role. The necessary IT operating data is ascertained from these assignments and used in creating the user accounts. Default values are used if valid IT operating data cannot be found over the primary roles.

    So, you have two options,

    • Option 1: Your IT Operating data has to rely on the primary memberships of your employee (Department, Cost center, Location, Business Role).
    • Option 2; Overwrite the script TSB_ITDataFromOrg with your own version that uses the secondary memberships as well. Please keep in mind, that a employee can have more than one secondary memberships in each of the role types. That can potentially lead to contradictory IT operating data, depending on your configuration data.
  • Dang it!

    I was afraid you were going to whack me over the head by quoting that paragraph.

    Ok maybe I can work with the profit center.

    I will rework my stuff and see where I get.
  • You could also re-architect from a dynamic business role to a template that assigns Person.UID_Org if you are not using that already.

    Sorry, didn't meant to be rude.
  • Hey Markus,

    No worries at all really.

    Since we do not leverage the cost center in our organization for the purposes of this product, I attempted to assign the account definitions and the IT Operating Data against the UID_ProfitCenter.

    Tried to move a bunch of users from one to the other and while the update ads account stuff ran, none of the users moved to the correct OUs in accordance to the ITO Data.

    My use case is rather simple I thought. If the user is of a particular class, to move them to a specific OU.

    While I can nest business roles with ITO Data for each, I would have to create the same business role under each org structure for each account class to support one set of entitlements.

    Just does not seem to scale.

    To simplify, I created (3) Profit Centers:

    • Employees
    • Consultants
    • Advisors

    Each have a standard account and mailbox definition. Each have specific ITO Data pointing the account def to the OU of choice.

    That didn't work, when assigning the users to the profit center, a bunch of accounts were disabled, re-enabled but never left the default OU (and I do not have "always use default" set on the ITO Data). .

    So I figured maybe I would just try to be explicit about the assignment by setting the UID_ADSContainer based on the profit center in the template as I am getting tight on time and need to demonstrate the efficacy of this simple use case.  

    So I applied the following:

     

    '$FK(UID_Person).UID_Department$
    '$FK(UID_Person).UID_Locality$
    '$FK(UID_Person).UID_ProfitCenter$
    #If ORG Then
    '$FK(UID_Person).UID_Org$
    #End If
    If CBool(Connection.Variables.Get("FULLSYNC")) = False Then
    Select Case ($FK(UID_TSBBehavior).ITDataUsage:Int$)
    	Case 0:'do not get data from employee
    	Case -1:'fill property initially from the ITData of the employee
    		If Not $[IsLoaded]:Bool$ Then
    			Value = TSB_ITDataFromOrg($UID_Person$, $UID_TSBAccountDef$, Base.TableDef.Columns("UID_ADSContainer")) 
    		End If
    	Case 1:'update property depending on ITData of the employee
    		Value = TSB_ITDataFromOrg($UID_Person$, $UID_TSBAccountDef$, Base.TableDef.Columns("UID_ADSContainer")) 
    End Select
    End If
    
    IF $FK(UID_Person).FK(UID_ProfitCenter).AccountNumber$ = "Employees" Then
    	Value = "d4fb36c3-5923-44ad-abb4-90448f85b311"
    	
    End if
    
    IF $FK(UID_Person).FK(UID_ProfitCenter).AccountNumber$ = "Consultants" Then
    	Value = "a71a8139-716b-4fc0-b38e-fdd949094596"
    	
    End if
    
    IF $FK(UID_Person).FK(UID_ProfitCenter).AccountNumber$ = "Advisors" Then
    	Value = "1def52eb-a354-47cb-bfac-5116194e60f1"
    	
    End if

     

    The idea here is just to force it to do what I want, but now I am getting an error when attempting to update the template.

     

    810306] Error during execution of 'CheckValues' in logic module 'ADS.Customizer.ADSAccount'.
    	at VI.DB.Entities.PermissionsEntity.<CallMethodAsync>d__64.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.InteractiveEntity.<CallFunctionAsync>d__57.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.EntityScriptLogic._TemplateMethod.<CallAsync>d__36.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.EntityScriptLogic.<_ExecuteTemplatesAsync>d__23.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.EntityScriptLogic.<_ApplyTemplateAsync>d__25.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.InteractiveColumn.<SetValueAsync>d__24.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.EntityLogicOperations.<ApplyChangesWithLogicAsync>d__0.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.CombinedEntityLogic.<CheckValuesAsync>d__18.MoveNext()
    [810029] Object of type ADSContainer does not exist in database or you do not have the relevant viewing permissions.
    	at VI.DB.Entities.CombinedEntityLogic.<CheckValuesAsync>d__18.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.DB.Entities.StateLessEntityLogic.<CheckValuesAsync>d__60.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at TSB.Customizer.DirectoryObjectEntityLogic.<_CheckContainer>d__6.MoveNext()
    	at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
    	at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
    	--- End of stack trace from previous location where exception was thrown ---
    	at VI.Base.TaskExtensions.<Convert>d__1`2.MoveNext()
    	at VI.DB.EntitySourceExtensions.<>c__DisplayClass29_0`1.<GetSingleValueAsync>b__0(TryResult`1 r)
    
    Crash report:
    
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 1c2f40a9-e8dc-4a2a-870c-08d2556be20e
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 2101bff9-5291-46e3-ab1f-6e1bb998c243
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object bc6ef10c-e3cd-468b-bc54-fdf4bf84d734
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 52b701fd-c1c7-41c8-9ade-af436b6dac8a
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object a3278b90-e29b-4f4d-87cb-f7e178fcc993
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 45dd7557-2525-4768-a6b8-9fe232d59061
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 566c41d4-8645-4401-a930-97e47866486c
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/QBM-E88E60AB1AA6459FA902582EE35E12B4 from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 14792bcd-15dc-4a5a-bfba-772ac7d485c0
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_helpdesk?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_notDummy?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_Private?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/QBM-E88E60AB1AA6459FA902582EE35E12B4 from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 33fb42cc-1a34-445b-9429-08ab307d9be1
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_helpdesk?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_notDummy?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_Private?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/QBM-E88E60AB1AA6459FA902582EE35E12B4 from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 33fb42cc-1a34-445b-9429-08ab307d9be1
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_helpdesk?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_notDummy?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_Private?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/QBM-E88E60AB1AA6459FA902582EE35E12B4 from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object d09b17ef-8869-4363-9e53-b729964b6f87
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_helpdesk?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_notDummy?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_Private?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/QBM-E88E60AB1AA6459FA902582EE35E12B4 from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 4994fe5a-fb83-4f3e-9380-75a92f595fe9
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_individ?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_helpdesk?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_notDummy?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class Person_Private?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/QBM-E88E60AB1AA6459FA902582EE35E12B4 from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 3cd4bd46-672f-4289-aed0-dd19f55f94c8
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_User_adress?
    2017-10-19 19:49:17	SqlLog	(1 ms) - select 1 where exists (select 1 from EX0MailUser where (UID_ADSAccount = '3cd4bd46-672f-4289-aed0-dd19f55f94c8'))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 2ms.
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_User_box?
    2017-10-19 19:49:17	SqlLog	(< 1 ms) - select 1 where exists (select 1 from EX0Mailbox where (UID_ADSAccount = '3cd4bd46-672f-4289-aed0-dd19f55f94c8'))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 1ms.
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_Configured?
    2017-10-19 19:49:17	SqlLog	(< 1 ms) - select 1 where exists (select 1 from PersonHasTSBAccountDef where ((UID_Person = 'd09b17ef-8869-4363-9e53-b729964b6f87') and (UID_TSBAccountDef = '660214bb-414d-481f-9e71-9823961107d5') and (XOrigin = 1)))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 1ms.
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_Shared?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/EX0-3105FAB47C9B474883B677C4E548362E from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 692371c1-2190-4dea-83f0-3f624f5c0318
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_User_adress?
    2017-10-19 19:49:17	SqlLog	(< 1 ms) - select 1 where exists (select 1 from EX0MailUser where (UID_ADSAccount = '692371c1-2190-4dea-83f0-3f624f5c0318'))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 1ms.
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_User_box?
    2017-10-19 19:49:17	SqlLog	(< 1 ms) - select 1 where exists (select 1 from EX0Mailbox where (UID_ADSAccount = '692371c1-2190-4dea-83f0-3f624f5c0318'))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 1ms.
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_Configured?
    2017-10-19 19:49:17	SqlLog	(< 1 ms) - select 1 where exists (select 1 from PersonHasTSBAccountDef where ((UID_Person = '6ef78b92-e952-463e-b0d7-1c5acc5aae34') and (UID_TSBAccountDef = '660214bb-414d-481f-9e71-9823961107d5') and (XOrigin = 1)))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 1ms.
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_Shared?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/EX0-3105FAB47C9B474883B677C4E548362E from cache. done in 0ms.
    2017-10-19 19:49:17	ObjectLog	Finding object classes for object 692371c1-2190-4dea-83f0-3f624f5c0318
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_User_adress?
    2017-10-19 19:49:17	SqlLog	(1 ms) - select 1 where exists (select 1 from EX0MailUser where (UID_ADSAccount = '692371c1-2190-4dea-83f0-3f624f5c0318'))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 2ms.
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_User_box?
    2017-10-19 19:49:17	SqlLog	(1 ms) - select 1 where exists (select 1 from EX0Mailbox where (UID_ADSAccount = '692371c1-2190-4dea-83f0-3f624f5c0318'))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 2ms.
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_Configured?
    2017-10-19 19:49:17	SqlLog	(< 1 ms) - select 1 where exists (select 1 from PersonHasTSBAccountDef where ((UID_Person = '6ef78b92-e952-463e-b0d7-1c5acc5aae34') and (UID_TSBAccountDef = '660214bb-414d-481f-9e71-9823961107d5') and (XOrigin = 1)))
    2017-10-19 19:49:17	ObjectLog	Run statement and fetch data done in 1ms.
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount_Shared?
    2017-10-19 19:49:17	ObjectLog	Result: False
    2017-10-19 19:49:17	ObjectLog	Is it member of entity class ADSAccount?
    2017-10-19 19:49:17	ObjectLog	Result: True
    2017-10-19 19:49:17	StopWatch	Getting DialogImages.ObjectBrowser/EX0-3105FAB47C9B474883B677C4E548362E from cache. done in 0ms.

     

    I have clearly gone off the rails here. 

     

    Should I be thinking about this differently? Recognize that the template script is not ideal but my goal was to demonstrate the concept and apply the appropriate mechanism as part of the solution.

    Any insights would be most welcomed.

     

    Thanks!

     

    Oh, and I am running this as a system account and most definitely have the appropriate perms to the db.

  • I am unable to say, why your approach with the cost center didn't work unless the TSBITDataMapping is not configured to search the cost center tree for the containers but in regards to your errors.

    The reason for the error is, that the UIDs specified (or at least one of them) is not present in the database or you do not have the necessary permissions.

    [810029] Object of type ADSContainer does not exist in database or you do not have the relevant viewing permissions.
  • Thanks Markus,

    Interestingly I am running in manager as the viadmin so I don’t think I have a permission issue per-say.

    Could be that I goofed the copy and paste of the UID_ADSContainer somehow. I will roll into the office in a bit, at which point I will check and report back.

    Glad to get ur confirmation that the ITO data against the profit center in your view should get it there, I will investigate some more and focus on making that the primary driver for ITO Data against my standard account definition.

    Then I should be able to remove that goofy forced template edit I made (which doesn’t work anyway).
  • Ok as per usual I was missing something.

    On default ITO Data setting for the account definition, I did not have one of the primary assignments selected. As such, the accounts ended up in the default location.

    Once I straightened that out, the behavior of the subordinate account definition OU for the domain functioned as expected.

    Thanks again for straightening me out.