[GCDS] - Disabled AD accounts to Suspend GSuite accounts

[timbo343]

I'm wondering if there is a way in GCDS to suspend GSuite accounts that have been disabled in AD?

 

I thought the lookup in GCDS for disabled accounts was:

 

(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=2))

 

however this search does not return any results.

[Reboot_IT]

Hello,

 

We have our "leavers" going into a leavers OU in AD. We then set a search rule on user accounts for that OU with the action to suspend the account.

 

We use Salamander so it automatically moves the accounts from our standard OU to the leavers OU.

 

Thanks

Edited March 4, 2020 by Reboot_IT

[localzuk]

We have all our search rules as such:

 

(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) and that seems to work.

[timbo343]

We have all our search rules as such:

 

(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) and that seems to work.

 

Does that only detect Enabled accounts or disabled accounts? I have read the following article and search terms aren't working for me

[localzuk]

That only detects enabled accounts. GCDS is set to disable accounts no longer found automatically.

 

So, this is an example rule:

 

 

And the User Accounts screen settings:

 

[timbo343]

I've been trying all after to get this to work with the string that you are using but it doesn't work as it should.

 

Whenever i run a sync it wants to enable the account that i have manually suspended on GSuite and manually disabled on AD.

 

I have noticed on your screen grabs that the options are different to mine, what version of GCDS are you using? We are using 4.7.3 - i wonder if there is a bug with it.

[bald_pig]

There is an option for it on GCDS somewhere, at my last school the Google accounts were suspended when we disabled the AD account.

[Garacesh]

Bit of a necrobump, but has this stopped working for anybody else?

 

My rule is:

(&(objectClass=user)(objectCategory=person)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

So any user, with an email address, who isn't disabled.

Yet it still syncs disabled users if I delete them from G Suite, and doesn't disable users in G Suite if they're disabled in AD.

 

Disregard. Granted my sync user read all permissions for user objects in those OU's and it's working properly again.

Edited June 29, 2021 by Garacesh