How to query managers with direct reports who have a specific attribute value

Question

Ideally looking to make this a rule based group, but report or business unit should work also. In our domain, service accounts become direct reports of the user who requested/created them. We want to query users who have atleast 1 actual human user direct report. As far as I can tell, the direct report criteria only have the functionality to filter empty/non-empty directreports attributes or if a specific object is a/not a direct report. Is this possible? Thank you

Answer 1

Hello Alex,

Unfortunately, there is no possibility to achieve the desired using just a criteria, a PowerShell script is required. As such, a custom report based on a PowerShell script is the best option. For information on how to create custom reports, have a look at the following tutorial: https://www.adaxes.com/help/CreateReport. The report will have a search scope (Objects located in a specific location) and two parameters. The first parameter will be used to select the subordinate property whose value will be checked. The parameter should be of the Property name picker type. The second parameter will be used to specify the value that must be present in the subordinate property. If the specified value matches the subordinate property value, the manager of the subordinate will be added to the report. To generate the report, the below script will be used. In the script:

• $propertyName – Specifies the name of the report parameter used to select the property. The parameter name must start with the param- prefix.
• $value – Specifies the name of the report parameter used to specify the property value. The parameter name must start with the param- prefix.

$propertyParamName = "param-Property" # TODO: modify me
$valueParamName = "param-Value" # TODO: modify me

# Get parameter values
$propertyName = $Context.GetParameterValue($propertyParamName)
$value = $Context.GetParameterValue($valueParamName)

# Build criteria
$criteria = New-AdmCriteria "user" -Expression {directReports -empty $False}

$Context.DirectorySearcher.AddCriteria($criteria)

# Build the report
try
{
    # Execute search
    $searchIterator = $Context.DirectorySearcher.ExecuteSearch()

    while ($Context.MoveNext($searchIterator))
    {
        $searchResult = $searchIterator.Current

        $manager = $Context.BindToObjectBySearchResult($searchResult)

        # Get subordinates
        $subordinatesGuids = $manager.GetEx("adm-DirectSubordinatesGuid")

        # Check if subordinate has the required property value
        foreach ($subordinateGuid in $subordinatesGuids)
        {
            $guid = [Guid]$subordinateGuid
            $subordinate = $Context.BindToObject("Adaxes://<GUID=$guid>")
            try
            {
                $propertyValue = $subordinate.Get($propertyName)
            }
            catch
            {
                continue
            }

            if ($propertyValue -ne $value)
            {
                continue
            }

            # Add manager to the report
            $Context.Items.Add($searchResult)
            break
        }
    }
}
finally
{
    # Release resources
    if ($searchIterator) { $searchIterator.Dispose() }
}