Disabling Accounts Via GCDS

[GraySkull]

Hi

 

How do you all manage disabling staff/student accounts for Google?

 

We disable them in AD but can not seem to get this to sync successfully with GCDS so are currently manually disabling accounts.

Does anyone have any advice on how to configure GCDS to sync disabled accounts with AD

[Oaktech]

I just do it manually. I find it quicker and more reliable than trying to get sync to work. We also seem to quite frequently have situations where we need one to continue to function but not the other so the sync option is more of a hindrance than a help anyway.

[ADMaster]

I've rarely had sync issues. Once or twice in 10 years an update broke things and I had to stay a version back for a while. Overall it works quite well.

 

Do you have your LDAP query set to look for only active users?

If so you can choose to delete or suspend them when they are disabled.

 

If you have special accounts in one system or the other, write exclusions.

 

Here is the LDAP query I use. The user account control section tells it to exclude disabled accounts. The mail section tells it to exclude anyone that does not have a school email listed.

This rule is repeated a few times to get just the user OUs I sync.

(&(objectCategory=person)(objectClass=user)(|(mail=*@school.org)(mail=*@school.us)) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))

[timbo343]

Ive always tried to get the rule

 

(&(objectCategory=person)(objectClass=user)(|(mail=*@school.org)(mail=*@school.us)) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

to work but failed - it returns all my users with an email address so i have added (st=suspend)

 

(&(objectCategory=person)(objectClass=user)(st=suspend)(|(mail=*@school.org)(mail=*@school.us)) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

meaning if the State attribute contains Suspend the account is suspended on the Google Domain.

[localzuk]

Our setup uses the rule:

 

(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

in a search rule. Has always worked for us. That only finds active users. Then we have the option "Suspend Google domain users not found in LDAP, instead of deleting them" set under User Attributes.

[jthompson]

We have sub-OUs in AD for storing leavers. GCDS is then configured with search rules for those OUs, set to suspend any matching Google accounts. The search rule for the respective parent OU is set to single-level only, to avoid it matching any leavers.

It means more search rules in GCDS, but it'll suspend/reactivate accounts for you according to where the user is in AD, rather than the AD object's status.