Condition on ADS_ADSGroup_update

Question

Hello, 
 
 Can we put a condition on ADS_ADSGroup_update so that it doesn't launch if there is no active AD account attached to the person. 
 
 We have a case where this Process is triggered on deactivated or deleted AD accounts and fails in Frozen state:

[1777182] Error resolving references of property (vrtMembersSID@ADSGroup) for system object (ad_group_xxx)! [810029] Object of type Active Directory user accounts does not exist in database or you do not have the relevant viewing permissions. 
 
 Is that possible? 
 
 Thank you

Trevor Pike · Answer

Just to be clear, and to step back on this, because modifying the condition is not necessarily best practice here. ADS_ADSGroup_update should only be generated when there is an update to a group, i.e membership change. Are you saying this is being activated due to changes to a deactivated or deleted ADSAccount? If that's the case it would be better to remove this account from any groups. Or not make any changes to the account at all. This is really about how you are managing accounts when they are deleted/deactivated. Is the account actually deleted? Is there a dynamic role associated with the group? Better to configure things so the group update is not triggered for these accounts rather than modifying code that could lead to probalems later on. Trevor

Endpoint Privilege Management

Condition on ADS_ADSGroup_update

Top Replies