Can FIM create OU in Active Directory

Experts,
Although I think answer must be YES but asking to confirm as I have not worked on FIM.
Can FIM also create OU in Active Directory?
Thanks,
Mann

Yes, you can either manage OUs separately or create them during user provisioning, given you set Hierarchical Provisioning up and running.
That's almost OOTB behavior of AD MA

Similar Messages

Creating users in Active Directory through LDAP connector

Hello,
If we need to create users in Active directory using LDAP connector, what are the options for the following:
1) Update back into SAP from AD. LDAP connector updates only in one direction i.e from SAP to Active directory.
2) Can we add additional fields in LDAPMAP which are not standard e.g can we we write our own code to extract data from HR to map the value with an attritube within Active directory?
Regards,
Ahmad

Hello!
I noticed the email in my inbox and understand the reason for deleting it - checked the rules again - no problem with that.
Here is the posting again - sanitized this time.
You can create users in LDAP/AD from SAP without a problem. SAP provides function modules to create/maintain/delete users with LDAP attributes in the correct ou path.
You can also perform group membership assignment in LDAP from SAP if needed.
I have done this quite a few times at different companies that use SAP HCM.
A userid in SAP is created automatically during hiring action with default password e.g. birthday of employee and certain authorization roles based on configured information.
The userid is then created right away in LDAP in the correct ou path (controlled via custom configuration table) and LDAP group membership is assigned.
A job runs every 8 hours to perform delta updates in LDAP.
The userid in SAP and LDAP are locked automatically if the user is terminated using termination action in HR.

Why can't create file under /home directory?

I user solaris10, and login as root,I find I can't create any file or directory under /home directory! It say "operation not applicable" ,Why? I am puzzled it for a long time. Anyone could tell how to do it?
Thanks

For Solaris,
/home is not an on-disk file system, it is a file system under the
control of the automounter, and only the automounter can create
directories/files in it.
If you don't want the automounter to manage /home, then remove the
"/home" entry from /etc/auto_master
(and issue the command "automount -v" to force the file
to be reread, or reboot).
However, the typical setup for Solaris is to locate user's home directories
in /export/home.
Kapil Khanna

Can i recover my all active directory domain computers and users from IFM and in-cooperate them in new forest ??

My only Active Directory Server on win server 2008 R2 with one domain controller crashed today. The only backup that i had was IFM media.
So what i have done till now to recover it is a follow
I reintalled window server but this time it is winserver 2012. I added AD DS role to it. Promoted it to Domain Controller. (functionality level is 2008 R2)
On second server i installed win 2008 R2 and trying to add additional domain controller from IFM to recover all of my domain users,computers and GPO's. but i am getting this error
Could not replicate the directory partition CN=schema, CN= configuration, DC=XXX, DC=com from the remote domain
the naming context specified for this replication operation is invalid
i dont know weather my approach is correct or not
but my simple questions is
Can i recover my all domain computers and users from IFM and in-cooperate them in new forest ?? if yes how can i do that?? urgent help required.

yup exactly i created a new domain(in new forest) with same previous name in window server 2012 on SERVER-1. As ifm file that i had was generated from 2008 r2 so on second server i installed window 2008 r2 and tried to add role of additional domain controller
from ifm file on SERVER-2 using dcpromo /adv . every step went ok but in last step when it starts replicating domain controllers it poup following error
Could not replicate the directory partition CN=schema, CN= configuration, DC=XYZ, DC=com. . .
and roll backs every thing.

How to create "folders" in Active Directory Users and Computers?

Hello Community
    In Windows Server 2008R2 when you go to Active Directory Users and Computer
you will see icons of folders such as:
    - Builtin has a folder icon
    - Computers has a folder icon
    - ForeignSecurityPrinicpals has a folder icon
    - Domain Controller as a folder icon
    - Managed Service Accounts has a folder icon
    - Users has a folder icon
    All of the above folders are visually identical.
    If you right click and select “File” – “New”
on any of the selections the icon
will not look like the folder icon they have their own icons which look different
from the "Folder" icon.
    I would like to create a “Folder” that looks just visually exactly like the ones
mentioned above, how can I create those types of Folders in Active Directory User
and Computers?
    Note: I would like to put users in the folders.
    Thank you
    Shabeaut

Hi,
you should use OUs (an OU is they type of object (folder) that is available for you to easily create.
The object type you are asking about is a "container", and there are various reasons why an OU is more flexible (applying GPO, etc).
Refer: Delegating Administration by Using OU Objects
http://technet.microsoft.com/en-us/library/cc780779(v=ws.10).aspx
and the sub-articles:
Administration of Default Containers and OUs
http://technet.microsoft.com/en-us/library/cc728418(v=ws.10).aspx
Delegating Administration of Account and Resource OUs
http://technet.microsoft.com/en-us/library/cc784406(v=ws.10).aspx
Also: http://technet.microsoft.com/en-us/library/cc961764.aspx
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Connected to Domain but can't log in using Actived Directory Credentials

Hey everyone. I've been working on this issue for two weeks now, and I don't know what else to try. I'm connected to my domain but cannot get my Macbooks to log in using Active Directory credenitals both through our wireless network, and hard wired with an ethernet cable. The weird part about it is that it is not uniform all across our network. This only happens to certain Macbooks and as of right now there doesn't seem to be a pattern. I can say that it has happened to all new Macbook Pros that we have ordered lately though.
We use Jamf to manage our Macs on our network, and ever since upgrading to a new version (9.01 and now 9.1) we have had this issue. However I can't connect after manually adding the domain either, so for now it makes me think it is not a Jamf issue. Has anyone dealt with this issue before, that might know of a fix? Thanks!

Hi Burnettb1,
I have come across a similar issue as yours. I have included the instructions that I use to bind the Mac at my institution. In regards to wifi, I have not tried binding the Mac over wifi. Should you need to log in to a Mac with domain user credentials I would suggest to bind the Mac over ethernet. Once you get to the:
*Click on triangle to the left of Show Advanced Options to expand"
portion of the instructions click on the Mappings tab and select the checkbox for creating a mobile account at login. This will create a domain user profile on the machine that you can log into when not connected to the domain.
Hope this helps.
BIND iMac:
          Login into iMac using administrative credentials
          Open System Preferences
                    *Goto Users & Groups
                    *Click on lock in lower left-hand corner
                    *Use same password used to log into iMac
                    *Click on Login Options
*Click on ‘Join...’ button right of "Network Account Server: "
                    *Click on ‘Open Directory Utility…’ button
                    *Click on lock in lower left-hand corner
                    *use same password used to log into iMac and click on Modify Configuration
                    *Double-click on Active Directory
Active Directory Domain = domain
                              Computer ID = name of Mac
                    *Click on triangle to the left of Show Advanced Options to expand
                              *Click on Administrative tab
                              *Check Prefer this domain server
Type domainserver_ipaddr -or- servername.domain in this field
                              *Click on ‘Bind…’ button
                              *When prompted for network administrator login
                                        username = [domain admin user]
                                        pwd = [domain user password]
                              *Click OK (Note: search path will be updating. Until completed the ‘OK’
button will be greyed out
*Click OK
*Click lock to lock and close window
                    *Click lock to lock and close window
BIND CHECK:
          *Search AD for added mac host - it should be there.
          Open Terminal app by either:
                    1)
                              *Press command+spacebar
                              *Type Terminal and select app
                    2)
                              *Click on desktop
                              *Press shift+command+A
                              *Goto Utilities folder located within Application folder (which you should
be in) and open Terminal
          *Once Terminal is opened type in id [domain username] and press return key. The output should be
some some network account information
          *Close app by pressing command+Q and any other opened windows
          *Restart iMac
          *Log in

Unable to create a specific Active Directory mobile Account

Dear Community,
I do have a problem with one workstation when I want to login with a specific Active Directory mobile user account. The login window will shake and refuse login due to invalid credentials... but this is not true, on other workstations the same account works without any problem. And also the Active Directory settings are verified and correct and other mobile account also work.
So I tried to create the mobile account manually via Terminal :
sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobilea ccount -n username
sudo createhomedir -c -u username
But this command results in an error that the account already exists, trying to delete, again an error null, etc... so no way.
So I tried to start up in Single-User-Mode and get into dscl to finally delete this mysterious account daemon... but again I'm resulting in an error:
dscl . -delete /Users/{username}
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)
Anyone any idea how to get this base cleaned so I can make this specific operator work on this specific Mac ? Help greatly appreciated. Thanks
Cheers

Could it be DNS cache?
http://old.nabble.com/%3Cdscl_cmd%3E-DS-Error%3A--14009-%28eDSUnknownNodeName%29 -td30706666.html
The LSAP DB?
http://old.nabble.com/Bad-Users!-td19172901.html
Or even this?
https://discussions.apple.com/thread/1448801?start=0&tstart=0

HT201358 Can ARD3 work with the Active Directory setup on a Windows machine and without the need of Open Directory

We need the 'Golden Triangle' setup to work with ARD3 running on a Mac server with client Mac details retrieved from a Windows Active Directory. In this system, the ARD3 will be used to install packages from a Mac OS X server, where the client Mac list is gathered directly from a Windows Active Directory, which is already in place.
So, please guide me whether Apple Remote Desktop 3 is capable of getting client machine details from an Active Directory without the need of re-creating the client Mac list in the Mac server running ARD3.
If ARD3 can not be used in this case, do you recommend any other tools that can resolve our issue.
Thank you in advance.
Sudheesh.

ARD cannot directly obtain client information from Active Directory, no. It may be possible to create a script that would get such information and be able to put it into ARD, but I wouldn't begin to know how to write such a script. You may also be able to bind your OS X Server to ARD and create groups there. This article is obsolete for 10.6 or later but may provide some clues as to how to proceed:
http://support.apple.com/kb/TA24276
There are a number of third-party systems that can manage Macs that may be able to draw information from AD, such as Casper, LANDesk, and others. Which if any would meet your needs depends on many factors including how many devices you need to manage, whether you're looking for a cross-platform tool, your budget, etc. This is a difficult issue to address in a forum like this since there are so many variables to be considered.
Regards.

How can I create a loopback activity

Hello All.
How can I create a loopback process in BPEL? For example: I have a flow that has a human task that submits a proposal. After
this, Theres is another human task that will review this proposal with Approve or Reject options. If it is approved, then the flow goes on. If it is rejected, then the flow has to go back to the proposal subimission process. You can see an image (the first image in the URL) that ilustrates this flow here: http://onbpms.com/2007/02/08/looping-backward/. The rest of the page is not important. Just look at the image to understand my problem. How can implement such loop in BPEL?
I´m using JDeveloper Studio Edition 10.1.3.2.0.4066 and SOA Suite 10.1.3.1.0
Thanks for any help,
Glauco

Yes, I have. This is the instructions that oracle gave me.
There are two approaches:
1) use WHILE bpel activity.
a) Have a variable initially set to N, and loop it till it becomes Y.
b) Inside the loop, you can have the assign activity, and human task call.
c) If the humantask result is Reject,continue the loop again
d) Else, set the variable as Y and end the loop
2) Use scope
For loopback process you can place the process in a scope and make use
of the replay scope method to repeat the scope.
a).Place the assign and UserTask in a single scope.
b) For the Reject condition in the swtich activity , place a throw
activity that throws a remoteFault.
c). Put a catch around the scope to handle the fault thrown by the Reject condition.
d). In this catch place a throw activity, with local part = replay. Choose the remoteFault fault and change de local part to replay
e). This would replay the whole scope when the reject condition is meet.
Both approaches work just fine.
Glauco

How to create user in Active directory

Hello,
I'm trying to create a user in active directory via the following example:
String userName = "cn=Jef Klak,ou=Ps Users,ou=Users,ou=Managed,dc=xxx,dc=local";
     Attributes attrs = new BasicAttributes(false);
     Attribute oc = new BasicAttribute("objectClass");
     oc.add("top");
     oc.add("person");
     oc.add("organizationalPerson");
     oc.add("user");
     attrs.put(oc);
          attrs.put("cn","Jef Klak");
          attrs.put("giveName","Jef");
          attrs.put("sn","Klak");
          attrs.put("displayName","Klak, Jef");
          attrs.put("description","IR");
          attrs.put("userPrincipalName","[email protected]");
          attrs.put("mail","[email protected]");
          attrs.put("company", "XXX");
          attrs.put("sAMAccountName","jk666");
attrs.put("userAccountControl",Integer.toString(UF_NORMAL_ACCOUNT + UF_DONT_EXPIRE_PASSWD+ UF_ACCOUNTDISABLE));
          Context result = fctx.createSubcontext(userName, attrs);
As a result I'm getting the following error:
javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece
remaining name 'cn=Jef Klak,ou=Ps Users,ou=Users,ou=Managed,dc=xxx,dc=local'
Anybody any tips or advice on this one? Or maybe a working examples how to add users in AD?
Listing entries in the AD is no problem, so it's only adding them.
Many thanks,
Filip

          attrs.put("giveName","Jef");
javax.naming.directory.NoSuchAttributeExceptionSpelling error.

Can't create an ExecuteWithParams activity in a bounded task flow

I'm trying to replicate the application in the demo, Passing Parameters to a TaskFlow on the URL - http://www.youtube.com/watch?v=3cklxe1qq5I
I created a ViewObject named PagerByLastName which has an iterator with the generated name, PagerByLastName1Iterator
(in Data Controls, a node is created for PagerByLastName , named PagerByLastName1
PagerByLastName1 has query with a parameter and binding variable for the parameter.
Next, I created a bound task flow and tried to drop an ExecuteWithParams from within PagerByLastName1 onto the bounded task flow.
However, in the Edit Action Binding dialog that opens, the Data Collection section is read-only and I'm unable to select a data collection to create
the ExecuteWithParams activity.
A warning message appears as I try to drop ExecuteWithParams -
"WARNING: IteratorNameNotFound--AppModuleDataControl1.PagerByLastName1"
However, the iterator name should be PagerByLastName1Iterator
Known issue? Is there any workaround?
Product Versions:
Oracle JDeveloper 11g Release 1 11.1.1.4.0
Studio Edition Version 11.1.1.4.0
Build JDEVADF_11.1.1.4.0_GENERIC_101227.1736.5923
Copyright 1997, 2011 Oracle and/or its affiliates. All rights reserved.
IDE Version: 11.1.1.4.37.59.23
Product ID: oracle.jdeveloper
Product Version: 11.1.1.4.37.59.23
Thanks,
John

Shay Shmeltzer wrote:
What do you mean when you say:
created a ViewObject named PagerByLastName which has an iteratorA view object should have a query in it with a bind parameter.Correction, I saw in the Data Bindings source an iterator is generated for the ViewObject .
The ViewObject does have both a query and bind variable defined for the parameter in the query.
The query is
select BEEPER, FIRST_NAME, MIDDLE_NAME, LAST_NAME, OUN from PERSON_ALL_V4 where ( ( ( UPPER(LAST_NAME) LIKE UPPER('%' || :lastname) ) OR ( :lastname IS NULL ) ) ) and cyber_status='Active'
lastname is the bind variable
I DnD the ExecuteWithParams node to the task flow and the Edit Action Bindings dialog opens, but I cannot select a data collection, the collections are collapsed
and can't be expanded.
Edited by: JWB on May 23, 2011 4:55 PM

Creating a simulated Active directory

Hi all,
I am studying IDM now and doing some exercises, one of them include making a simulated file of an AD, but it doesn't work like an Active directory at all.
I installed the gateway but didn't see how can I connect a simulated file to the gateway. and when I try to use cn=.... and so on, I simply get the string as the userid which prevents me from using it to seed the users with the other simulated files.
How can I simulate an AD or what should I set so the cn=.... string will work correctly.

Well I made an oraganization called XYZCompany.
And then connected the AD simulated resource to an xml file using the following:
cn=$login$,ou=$division$,ou=$department$,dc=$xyzcompany,dc=com
when I did a full reconcile on IDM 6 it didn't put the user accounts into XYZCompany, it put them in top and with a user name as long as the string above. Did excatly the same with IDM 5 and it inserted the login name into the XYZCompany organization and I could work with it.

Can Dreamweaver create the remote root directory?

Hi,
Does Dreamweaver have the capability to create the remote
root directory? As an example, if I define a remote site and I set
the host directory to public/site3 where the public directory
already exists on the server but site3 directory does not, can
Dreamweaver create the site3 folder? Other programs will notify
that the directory does not exist and ask if you'd like for it to
be created. Dreamweaver just seems to give me error messages.
I'm currently using a straight FTP program to create the
directory before I define the remote site but it seems ridiculous
to have to do this.
Thanks!
Julie

> can Dreamweaver create the site3 folder?
Sure.
But - what do you expect this to do for you? Are you trying
to have
multiple sites on a single hosting account?
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.dreamweavermx-templates.com
- Template Triage!
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
http://www.macromedia.com/support/search/
- Macromedia (MM) Technotes
==================
"[email protected]"
<[email protected]> wrote in message
news:fbutc7$88f$[email protected]..
> Hi,
>
> Does Dreamweaver have the capability to create the
remote root directory?
> As
> an example, if I define a remote site and I set the host
directory to
> public/site3 where the public directory already exists
on the server but
> site3
> directory does not, can Dreamweaver create the site3
folder? Other
> programs
> will notify that the directory does not exist and ask if
you'd like for it
> to
> be created. Dreamweaver just seems to give me error
messages.
>
> I'm currently using a straight FTP program to create the
directory before
> I
> define the remote site but it seems ridiculous to have
to do this.
>
> Thanks!
> Julie
>

Add random number to a email id while creating account in active directory

Hi,
I have this code with me,
in this code i am creating user account into the active directory, i am facing issue in validating it.
validation is: Let's say we got 2nd Aman verma into the active directory, first aman verma got id as [email protected], i want id of second aman verma as [email protected] (or any other number at the place of 1)
below is my code,
using System;
using System.IO;
using System.DirectoryServices;
namespace ActiveDirectoryAddContacts
class Class1
static void Main(string[] args)
System.DirectoryServices.DirectorySearcher DSESearcher = new System.DirectoryServices.DirectorySearcher();
string RootDSE=DSESearcher.SearchRoot.Path;
RootDSE=RootDSE.Insert(7,"ou=Mytest,");
DirectoryEntry myDE = new DirectoryEntry(RootDSE);
DirectoryEntries myEntries = myDE.Children;
// Create a new entry 'Sample' in the container.
FileStream fs = new FileStream("C:\\UserDetails.csv" , FileMode.OpenOrCreate, FileAccess.Read
StreamReader sr = new StreamReader(fs);
for(int i=1;i<291;i++)
string str = sr.ReadLine();
char[] ca={','};
try
string[] sa = str.Split(ca,4);
DirectoryEntry myDirectoryEntry = myEntries.Add("CN="+sa[2], "user");
myDirectoryEntry.Properties["givenname"].Value=sa[0];
//myDirectoryEntry.Properties["sn"].Value=sa[1];
//myDirectoryEntry.Properties["displayname"].Value=sa[2];
//myDirectoryEntry.Properties["mail"].Value=sa[3];
//myDirectoryEntry.CommitChanges();
catch (Exception e)
Console.WriteLine(str);
any Help will be highly appreciated.
Thank you!
Aman

Hi,
As this might not be a SharePoint issue, I suggest you open a thread in the Windows Server forum, you will get more help and confirmed answers there:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverDS
Thanks
Patrick Liang
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

How can I create a manual activity that waits a specific number of seconds

Hi
I need to create a manual activity that waits a specific number of seconds. Is there a way to do that?
Regards

If you have a manual activity (Human Task) and you would like to define a task deadline in order to continue the process you can define it in the task definition as desribed here: Configuring Human Tasks - 11g Release 1 (11.1.1.6.1)
But if you just like to stop the process without manual activities involved you can ideed use the Timer Catch Event. See section "6.8.2 Introduction to the Timer Catch Event" in Modeling Business Processes with Oracle BPM for further details.
Regards, Danilo

Can FIM create OU in Active Directory

Similar Messages

Maybe you are looking for