Assignment and promotion of AD Group

You mean changing the assignment from indirect to direct assignment?

I have done it with a process which ADSAccountInADSGroup -assign event triggers and that process changes the xorigin to 3

Thank you Timo.

No, I need to change the Primary group assignment on AD accounts, in order to remove DomainUsers group and set a custom one.

Lucrezia

ah sorry I understood wrongly.
I don't know but could it be so simple as modifying the value template of ADSAccount.UID_ADSGroupPrimary?

l tonelli Did you find a solution for this? I am looking at the same use case and thinking of something like this (untested)

1. Create the ADSAccount and automatically assign the new ADSGroup and Account Definition through primary business role
2. A process triggered by Insert on ADSAccount that first waits for ObjectGUID and group membership, then set UID_ADSGroupPrimary to the new group, and removes the old primary group from ADSAccountInADSGroup

Are

Hi Lucrezia,

you may change the primary group membership of ADSAccount to any group where the ADSAccount is already member only. So the proposed process of Are should have a step 1a) add group membership to ADSAccount (new primary group)

Having this in place you are allowd to change the FK UID_ADSGroupPrimary to the new group.

Regards,

   Tino

Hi Are,

yes you are right. In practice, you first have to assign the group as a standard membership, then you select it as primary. The one that was primary becomes a normal membership and now you can delete it.

Lucrezia