Update in field XIsInEffect of table ADSAccountInADSGroup

Hello,

I need to update the "XIsInEffect" field of the "ADSAccountInADSGroup" table. When an employee is deactivated I need to have the AD account activated and I add some AD groups and other groups are deallocated. These unassigned groups, if the employee is activated, you need to reassign them

My idea is update the "XIsInEffect" field of the "ADSAccountInADSGroup" table for deallocated. But i have the error:

You cannot change values of read-only objects.

Is it possible?

Greetings.

Parents
  • Hi,

    Seems odd that the employee is deactivated but the AD account is active ...... I guess you have your reasons.

    If you want 'some' group memberships to be retained and others to be 'removed' ...... to be put back later on employee reactivation ...... it sounds like you need to have these memberships assigned by dynamic roles.

    HTH, Barry.

  • I will explain it to you with an example.

    I have an active employee with their AD account and they have:

    - two groups of AD by direct assignment. This is because the employee requests it to System

    - Five groups of AD by indirect assignment. These groups are assigned using a dynamic role when a employee is activated

    Now the employee is disabled. Thus,

    - The five AD groups by indirect assignment are deallocated by the dynamic role.
    - Add two AD groups by indirect assignment. They add by a dynamic role that I have when a employee is desactivated
    - The groups AD by  direct assignment are deallocated. How can I deallocated these groups? I can not delete because if the employee is activated again, these groups are assign again

Reply
  • I will explain it to you with an example.

    I have an active employee with their AD account and they have:

    - two groups of AD by direct assignment. This is because the employee requests it to System

    - Five groups of AD by indirect assignment. These groups are assigned using a dynamic role when a employee is activated

    Now the employee is disabled. Thus,

    - The five AD groups by indirect assignment are deallocated by the dynamic role.
    - Add two AD groups by indirect assignment. They add by a dynamic role that I have when a employee is desactivated
    - The groups AD by  direct assignment are deallocated. How can I deallocated these groups? I can not delete because if the employee is activated again, these groups are assign again

Children