Workflow Approval Logic - Computer Objects in OU

Question

Hi,

How would you most elegantly do the following?

Every time a request is made to move a computer account into OU XYZ, workflow approval should be sent before the move takes place.

If the computer account is being moved from OU XYZ, it does not need workflow approval.

Thanks!

Answer 1

Hello,

Actually, you can do this very easily. You need to create a Business Rule triggered before moving a computer that will send the operation for approval only if the target OU is your OU XYZ. To create such a Business Rule:

1. Create a new Business Rule.

2. On the 2nd step of the Create Business Rule wizard, select Computer and Before Moving a Computer.
   

3. On the 3rd step, add the Send this operation for approval action and specify the approvers.
   

4. Click OK.

5. Now, to configure the Business Rule to send the operation for approval only when a computer is moved to a certain OU, you need to add a condition. Double-click Always.

6. To check which folder a computer is being moved to, you need to use a script. Select the If PowerShell script returns true condition.

7. Paste the following script in the Script field.
   

    $ouDN = "OU=My OU,DC=domain,DC=com" # TODO: modify me
   
    # Get the target container
    $targetContinerDN = $Context.Action.TargetContainer.Get("distinguishedName")
   
    $ouDN = New-Object "Softerra.Adaxes.Ldap.DN" $ouDN
    $targetContinerDN = New-Object "Softerra.Adaxes.Ldap.DN" $targetContinerDN
    $Context.ConditionIsMet = $ouDN -eq $targetContinerDN
   

8. In the script, $ouDN specifies the distinguished name (DN) of the OU a computer should be moved to in order to trigger execution of the Business Rule. Modify it to match your requirements.

9. Enter a short description for the script and click OK.

10. Finish creation of the Business Rule.

Comments

Thank you. Works like a champ!