Assignment and promotion of AD Group

l tonelli Did you find a solution for this? I am looking at the same use case and thinking of something like this (untested)

1. Create the ADSAccount and automatically assign the new ADSGroup and Account Definition through primary business role
2. A process triggered by Insert on ADSAccount that first waits for ObjectGUID and group membership, then set UID_ADSGroupPrimary to the new group, and removes the old primary group from ADSAccountInADSGroup

Are

l tonelli Did you find a solution for this? I am looking at the same use case and thinking of something like this (untested)

1. Create the ADSAccount and automatically assign the new ADSGroup and Account Definition through primary business role
2. A process triggered by Insert on ADSAccount that first waits for ObjectGUID and group membership, then set UID_ADSGroupPrimary to the new group, and removes the old primary group from ADSAccountInADSGroup

Are

Hi Lucrezia,

you may change the primary group membership of ADSAccount to any group where the ADSAccount is already member only. So the proposed process of Are should have a step 1a) add group membership to ADSAccount (new primary group)

Having this in place you are allowd to change the FK UID_ADSGroupPrimary to the new group.

Regards,

   Tino

Hi Are,

yes you are right. In practice, you first have to assign the group as a standard membership, then you select it as primary. The one that was primary becomes a normal membership and now you can delete it.

Lucrezia