Revoke group membership after X days?

Question

Is it possible to configure a trigger so that it automatically removes an AD user from an AD group, x days after they were added?

For instance, if we have a group that grants access to an MFA bypass, but we only want people to be able to have membership for 3 days before being removed...

Instead of constantly auditing that group, could we make a custom command something like:

IF ((user was added to group)) >= 3 days, THEN ((remove them))

I haven't used Adaxes custom attributes before, but maybe when a user is added to that group, setting the DateTime in an attribute, then comparing to that in the removal action?

Thanks for any advice!

Answer 1

Hello jake,

Have a look at the solution in the following article: https://www.adaxes.com/script-repository/temporary-group-membrship-s533.htm.