Expected Busines Rule behavior

Question

I'm creating a business rule to identify active non-employee accounts (sub contractors, temps, etc). These employees are members of a special group. I have created two membership rules:

Include: Groups Members of Domain\Contractors group *Included by the Group Members rule.
Exclude: (userAccountControl:1.2.840.113556.1.4.803:=2) *Exclude by Query to remove disabled users

The membership rules work individually, however, I'd expect to see only Contractor accounts that are Enabled. I see contractor accounts that are disabled as well.

Is there anyway to make the exclusion rule 'override' the inclusion rule?

Answer 1

Hello,

The thing is that if an AD object is included in a Business Unit by one membership rule and excluded by another, membership is determined by the priority of these rules. In your case, a Query Result rule has lower priority and is ignored. You can find more information on Membership Rule priority in the http://www.adaxes.com/help/?BusinessUni ... rview.html help article.

To get around the issue, you can create a single Membership Rule that would specify both the criteria for including the objects and the criteria for excluding them. For example:

• You can use a rule of the Query Results type with the following LDAP query filter:
  (&(sAMAccountType=805306368)(memberOf=CN=Contractors,DC=example,DC=com)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
  This query will include enabled users who are direct members of the Contractors group. However, if certain non-employee accounts are members of the Contractors group via membership in other groups, this query filter will not include them.
• If non-employee accounts can be defined via a certain attribute of their user accounts (for example, Employee Type), you can use a rule of the Query Results type with the following LDAP query filter:
  (&(sAMAccountType=805306368)(|(employeeType=Contractor)(employeeType=Temp))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
  This query looks for enabled user accounts of the specified type (for example, Contractor or Temp).

If none of the solutions works for you, can you describe your situation in more detail? How are you going to use the Business Unit? Are there any other ways to determine non-employees besides membership in the Contractors group?