ITOperating Data UID_ADSContainer assigned based on Dynamic Role

Question

Hola, 
 Ok so I have commandeered a custom property on the person to be a list item with (3) values: 
 
 Employee 
 Consultant 
 AvisoryMember 
 
 I have created corresponding dynamic roles to match the above. Lets take employees as our example. 
 Couple of notes: 
 
 Person records that have the value "Employee" in the custom property are appropriately assigned to the Dynamic Role called "Employees" 
 Every employee gets: 
 
 A standard user account definition (Works fine) 
 A standard Mailbox (Standard user account as required account def. works fine as well)

The "Employee" dynamic role has IT Operating Data assigned against the Standard user Account Definition that should assign the OU of the ADSAccount based on the value. 
 
 Example: TSBAccountDef:Standard User Account (DOMAIN) - ADSAccount.UIDADSContainer
 
 The selected OU is "Employees"

The ADSAccount.UID_ADSContainer template is configured as follows: 
 
 '$FK(UID_Person).UID_Department$
'$FK(UID_Person).UID_Locality$
'$FK(UID_Person).UID_ProfitCenter$
#If ORG Then
'$FK(UID_Person).UID_Org$
#End If
If CBool(Connection.Variables.Get("FULLSYNC")) = False Then
Select Case ($FK(UID_TSBBehavior).ITDataUsage:Int$)
	Case 0:'do not get data from employee
	Case -1:'fill property initially from the ITData of the employee
 If Not $[IsLoaded]:Bool$ Then
 Value = TSB_ITDataFromOrg($UID_Person$, $UID_TSBAccountDef$, Base.TableDef.Columns("UID_ADSContainer")) 
 End If
	Case 1:'update property depending on ITData of the employee
 Value = TSB_ITDataFromOrg($UID_Person$, $UID_TSBAccountDef$, Base.TableDef.Columns("UID_ADSContainer"))
	
	End Select
End If

The issue is that while the dynamic role assignments work great, the corresponding ADSAccount does not move into the OU. I presume that I am missing something as this seems to be a rather straight forward use case. 
 What am I doing wrong here? 
 Thanks!

Markus Weiss-Ehlers · Accepted Answer

I believe the obvious thing here is wrong. I m quoting from the online manuals here: 
 
 An employee is assigned to one primary location, one primary department, one primary cost center or one primary business role. The necessary IT operating data is ascertained from these assignments and used in creating the user accounts. Default values are used if valid IT operating data cannot be found over the primary roles. 
 
 So, you have two options, 
 
 Option 1: Your IT Operating data has to rely on the primary memberships of your employee (Department, Cost center, Location, Business Role). 
 Option 2; Overwrite the script TSB_ITDataFromOrg with your own version that uses the secondary memberships as well. Please keep in mind, that a employee can have more than one secondary memberships in each of the role types. That can potentially lead to contradictory IT operating data, depending on your configuration data.

Markus Weiss-Ehlers · Answer

I am unable to say, why your approach with the cost center didn't work unless the TSBITDataMapping is not configured to search the cost center tree for the containers but in regards to your errors. 
 
The reason for the error is, that the UIDs specified (or at least one of them) is not present in the database or you do not have the necessary permissions. 
 
[810029] Object of type ADSContainer does not exist in database or you do not have the relevant viewing permissions.

pacman_d · Answer

Ok as per usual I was missing something. 
 
On default ITO Data setting for the account definition, I did not have one of the primary assignments selected. As such, the accounts ended up in the default location. 
 
Once I straightened that out, the behavior of the subordinate account definition OU for the domain functioned as expected. 
 
Thanks again for straightening me out.

Endpoint Privilege Management

ITOperating Data UID_ADSContainer assigned based on Dynamic Role