Hello Ben,
Thank you for the provided details. Below is the script to perform the direct reports transfer. It should be executed in a business rule triggering After disabling a user on the condition that the user has direct reports.
In the script:
- $helpDeskEmail – Specifies the helpdesk email address.
- $noEmailSubjectTemplate – Specifies a template for the subject of the email notification that will be sent to helpdesk in case any of the required recipients has no email address specified. In the template, the {0} placeholder will be replaced with the username of the account gaining direct reports from the leaver.
- $noEmailNotificationTemplate – Specifies a template for the email notification that will be sent to helpdesk in case any of the required recipients has no email address specified. In the template, the {0} placeholder will be replaced with the username of the account gaining direct reports from the leaver.
- $userManagerSubject – Specifies the subject of the email notification that will be sent to the leavers manager if they gain direct reports.
- $userManagerEmailNotification – Specifies the email notification that will be sent to the leavers manager if they gain direct reports.
- $noManagerSubject – Specifies the subject of the email notification that will be sent to helpdesk in case the leavers manager should gain direct reports, but there is no manager specified.
- $norManagerEmailNotification – Specifies the email notification that will be sent to helpdesk in case the leavers manager should gain direct reports, but there is no manager specified.
- $successSubjectTemplate – Specifies a template for the subject of the email notification that will be sent to the leaver and the manager with unique Job Title when the latter gains direct reports. In the template, the {0} placeholder will be replaced with the username of the account gaining direct reports from the leaver.
- $successEmailTemplate – Specifies a template for the email notification that will be sent to the leaver and the manager with unique Job Title when the latter gains direct reports. In the template, the {0} and {1} placeholders will be replaced with the username of the account gaining direct reports from the leaver.
$helpDeskEmail = "recipient@domain.com" # TODO: modify me
# Recipient has not email address settings
$noEmailSubjectTemplate = "No email address specified for %username% or {0}" # TODO: modify me
$noEmailNotificationTemplate = @"
Dear helpdesk
%username% or {0} does not have a valid email associated to one or both of these accounts. Could you please investigate.
"@ # TODO: modify me
# Target user manager mail settings
$userManagerSubject = "%username% Direct reports have been transferred to you" # TODO: modify me
$userManagerEmailNotification = @"
Dear %adm-ManagerUserName%,
The direct reports of %username% have been transferred to you and should be manually re-assigned in IAM to %username%’s replacement.
Regards
IT
"@ # TODO: modify me
# Target user has no manager
$noManagerSubject = "No manager specified for %username%" # TODO: modify me
$norManagerEmailNotification = @"
Dear Helpdesk,
The user: %username% has recently been deactivated, however there is no recorded manager in AD for this user therefore the direct reports of %username% cannot be automatically transferred to the replacement of %username%. Please can you identify the manager of %username% and update the information.
Regards
"@ # TODO: modify me
# New manager with same title settings
$successSubjectTemplate = "Direct reports have successfully been transferred to {0} account" # TODO: modify me
$successEmailTemplate = @"
Dear %adm-ManagerUserName% and {0}
The direct reports of %username% have successfully been automatically transferred to {1} Please confirm that the list of direct reports is correct and that no further action needs to be performed.
"@ # TODO: modify me
function UpdateManager($newManagerDN)
{
$redirectReportDNs = $Context.TargetObject.GetEx("directReports")
foreach ($redirectReportDN in $redirectReportDNs)
{
$directReport = $Context.BindToObjectByDN($redirectReportDN)
$directReport.Put("manager", $newManagerDN)
$directReport.SetInfo()
}
}
# Search parameters
$searcher = $Context.BindToObject("Adaxes://rootDSE")
$filterPart = [Softerra.Adaxes.Ldap.FilterBuilder]::Create("distinguishedName", "%distinguishedName%")
$searcher.SearchFilter = "(&(sAMAccountType=805306368)(title=%title%)(!$filterPart))"
$searcher.SearchScope = "ADS_SCOPE_SUBTREE"
$searcher.SizeLimit = 2
$searcher.ReferralChasing = "ADS_CHASE_REFERRALS_NEVER"
$searcher.VirtualRoot = $True
try
{
# Execute search
$searchResultIterator = $searcher.ExecuteSearch()
$searchResults = $searchResultIterator.FetchAll()
}
finally
{
# Release resources
if ($searchResultIterator){ $searchResultIterator.Dispose() }
}
if ($searchResults.Length -eq 1)
{
$newManager = $Context.BindToObjectBySearchResult($searchResults[0])
$newManagerDN = $newManager.Get("distinguishedName")
UpdateManager $newManagerDN
# Get new manager email
try
{
$managerEmail = $newManager.Get("mail")
}
catch
{
$managerEmail = $NULL
}
# Send mail
$managerUsername = $newManager.Get("sAMAccountName")
if ((-not([System.String]::IsNullOrEmpty($managerEmail))) -and (-not([System.String]::IsNullOrEmpty("%mail%"))))
{
$subject = [System.String]::Format($successSubjectTemplate, @($managerUsername))
$message = [System.String]::Format($successEmailTemplate, @($managerUsername, $managerUsername))
$Context.SendMail("$managerEmail, %mail%", $subject, $message, $NULL)
}
else
{
$subject = [System.String]::Format($noEmailSubjectTemplate, @($managerUsername))
$message = [System.String]::Format($noEmailNotificationTemplate, @($managerUsername))
$Context.SendMail($helpDeskEmail, $subject, $message, $NULL)
}
}
elseif (-not([System.String]::IsNullOrEmpty("%manager%")))
{
UpdateManager "%manager%"
# Send mail
if ((-not([System.String]::IsNullOrEmpty("%adm-ManagerEmail%"))) -and (-not([System.String]::IsNullOrEmpty("%mail%"))))
{
$Context.SendMail("%adm-ManagerEmail%, %mail%", $userManagerSubject, $userManagerEmailNotification, $NULL)
}
else
{
$subject = [System.String]::Format($noEmailSubjectTemplate, @("%adm-ManagerUserName%"))
$message = [System.String]::Format($noEmailNotificationTemplate, @("%adm-ManagerUserName%"))
$Context.SendMail($helpDeskEmail, $subject, $message, $NULL)
}
}
elseif ([System.String]::IsNullOrEmpty("%manager%"))
{
# Send mail
$Context.SendMail($helpDeskEmail, $noManagerSubject, $norManagerEmailNotification, $NULL)
}