Creative Tech

New Website - www.umrahelp.com

2010-05-13T08:58:00.001-07:00

As many of you know, or have been following. http://umratips.blogspot.com/ and http://activedirectoryadmin.blogspot.com/ are now combined into 1 easy webpage http://www.umrahelp.com. I've been meaning to combine both of the sites for awhile now, however, I've been just so busy with work and home life, that I haven't been able to get around to it.
However, little by little, I was able to finally get almost everything transfered over from the other blogs onto here.

So for any of you who have the old sites bookmarked, please bookmark this site, since the old ones wont be updated anymore.

UMRA – Get attribute (AD) Example Tips and Help

2009-08-23T10:31:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail.com

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Get attribute (AD) Example Tips and Help

LDAP attribute display name -
This will be the active directory LDAP name such as cn, canonicalname, memberof, etc. A list of these can be found on the internet. If you do not see a attribute value name in the drop down, you can type in the attribute name into the text box.

Attribute value -
This will be the new value of the LDAP attribute you want to set. Now keep in mind that some attributes take specific data types, and store information in a specific format

Skip if new value empty –
Turn this flag to yes, if you want to skip the update, if the value you are passing to the active directory attribute is black or has no value, this will keep it from setting the attribute to %your_variable%.

Multi-value flag –
Turn this flag to yes, if you are going to update an attribute that has multi values being passed to it, such as the memberof attribute, you can now pass it a string of dn’s of groups.

Append versus update multi-value-flag –
Turn this flag on if you want to just update the group memberships of a person, or another active directory attribute, this property allows to just add to the current value, instead of over right anything that is in there.

So there you have it, as you can see the UMRA action Set attribute (AD) is one of the most widely used actions in most any project. If you have any questions feel free to email me.

UMRA – Generic Data Table For Each Loop

2009-08-21T20:55:00.000-07:00

UMRA – Generic Data Table For Each Loop

Now, I have yet to cover in dept the UMRA action For Each, we talked about it a bit in past blog in conjunction with other UMRA functions, however, in this blog we will talk about how and why you would use this For Each Loop on a Generic Data Table. If you’ve been messing around with UMRA some, and know your way around, you most likely have had to loop through a table of data, either containing users, groups, or any other set of active directory objects, that you need to check on, or run some other script on. Personally, the For Each Loop in UMRA actions, is the main action that I use to loop through and process records of data. This is the primary action used when running a student information system sync with Active Directory, or a HR system sync with Active Directory.

For Each Loop -
What a For Each does, is exactly what its name says “For Each”… So for each record in your table of data, it will “do something”, such as execute another project. So, you can have a table of data, of all users in a particular OU, and for each user, you want to move their home drive folder to another server, then update the active directory attribute. This is exactly what its used for, it will pass each record of the table over one by one, passing whatever data you’ve collected in the UMRA database. Now, your script you want to send “each set of data” to, will be like most UMRA scripts you’ve created that process users. Now keep in mind your “process script” will look like a script that is only going to be run on one user at a time, and it will with each pass of the UMRA For Each loop. In most cases you will have a UMRA get user action, that will get the attributes you want to check or verify, or you can pass these in your for each its up to you. Now, don’t forget to put some type of error logic on your “process” script, this will make it so if you run into any problems with your script, you can log out your user that threw an error etc.

So there you have it, the UMRA For Each Loop on a Generic table in a nutshell. Now, again this is one of the most useful actions in UMRA, so you will most likely use this procedure over and over again, as your UMRA projects grow. If you have any questions, please feel free to let me know.

UMRA – Web Based Portal Access Control Security Model

2009-08-20T17:49:00.001-07:00

Have Questions? Email Me: Email Me Click Here

Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download
Download Enterprise Single Sign On Manager > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Web Based Portal Access Control Security Model

Anytime you build a UMRA based portal, or we build a UMRA based portal for our clients, one of the biggest steps in development is the creation of the Security Model, or in other words your Role Based Access Types RBAC. These security / delegated permissions can range from just one type of RBAC type to access the portal, or it can be an array of RBAC types with different Roles in the portal. For example, some of our clients might use a UMRA based portal only for Password Resets that are delegated out to Secretaries of a school or business there for, the Security Model wont need to be that large, since only one type of user is entering the portal. However, if you have Secretaries being able to change active directory passwords, and you want managers, to have the ability to update active directory attributes, you will need to have multiple types of RBAC types, since you don’t want to delegate the ability to secretaries to change users active directory attributes. Now you’re most likely asking yourself, what is the best way to go abouts setting up a Security Model for your UMRA based portal? Almost 95% of the time when I develop portals for our clients, they use Group Based Access, so if someone is in GROUP X in active directory, we will consider this type of user “Admin” for example.

So this is one way of figuring what type of a Security Model is looking at the users active directory group memberships to determine what type of user they are, or what type of RBAC type they are. As I’ve mentioned above, you can search a users groups for “Group X” if a user has this ground in there memberof attribute (the memberof attribute contains all DN’s of groups in active directory), then we can label this user as Type X user. Now if a user has multiple Groups you have designated for RBAC types, you can either display a drop down to the user upon login, for them to select what type of ROLE they want to be in when they enter the portal.

Now this is one way to setup a Security Model on your UMRA based portal. In my next blog I will talk about creating a METABASE for your figuring our your RBAC types. I hope this helps any of you out there with trying to do such a task, if you have questions feel free to ask.

UMRA – LDAP Power School Sync With Active Directory

2009-08-19T20:16:00.001-07:00

UMRA – LDAP Power School Sync With Active Directory

Now most of you out there have heard of the Student Information System SIS called Power School. This is a popular SIS that allows for school districts to manage students and faculty in active directory and other systems. However, one of the biggest drawbacks to these systems is the lack of LDPA connections for automation of data changes, and data creations. This is exactly where UMRA comes into play, since UMRA has the ability to connect to almost any ODBC complaint database, or even data from a CSV or network data, UMRA can take all this data and create the LDAP sync with Power Scholl that you’re looking for. Now, some of you might be asking what are the limitations of UMRA LDAP Power School Sync, the answers is really none. Yes, none. UMRA has the ability to take the SIS Power School SIS and sync it with Active Directory. UMRA can create, modify, or move any active directory object on an automated schedule. The days of spending countless weeks or hours moving students, updating students are over, UMRA can now link to Power School, compare all the current Student Records with those in active directory. Below is a quick overview of one of the many scenarios we automate for our Power School Clients.

End of the year “Round Up” -
This process is sometimes called that, or maybe something else your company might call it. What the “Round Up” is, is the process you have for when all your students move up a grade. In most cases our clients have to move students, update Active Attributes, move home drives, or even move exchange email accounts from one mail serve to the next. As we all know this is a very long process, that can take weeks, however with UMRA LDAP Power School Sync this process is done with ease, and all in the background. UMRA can take the data in Power School, sync it with Active Directory compare it against the Power School Data. If something is different such as Grade, Name, or anything else. UMRA can take that user object, and move them, reapply group memberships, move home drives to mapped servers, reapply security to those folders, all automated.

Now I hope this gives anyone out there a better idea of how flexible UMRA is in creating a UMRA LDAP Power School Sync. As you can see, the limitations are minimal; since UMRA can mimic any work flows you have now, and put those on an automated schedule. If you have any questions feel free to email me.

UMRA – Bulk Reset Active Directory User Password Last Set

2009-08-18T20:23:00.000-07:00

UMRA – Bulk Reset Active Directory User Password Last Set

Just recently I was tasked with resting eight thousand Active Directory Users Password Last Reset attribute. The issues came about after our client previously edited all these users, yes you heard right, manually edited these users for a 60 day password expiration. However, some of their project deadlines were pushed back, and if these users passwords expired, they would be locked out of multiple systems. So this is a perfect example of where to use UMRA bulk capabilities to manage all of this. The previous manual method took them over 3 days with 2 full time staff working on this, however, running this change with UMRA took me 20 minutes, and I even logged all my data to a text file for the client. So How did I change this Active Directory attribute, to set the Password Last Set to today’s date, so it would give them another 60 days of grace time? Easy, since UMRA has the ability to loop through a set of users, either from network data, a CSV, or a table of users in an OU, or multiple OU’s. I was able to quickly create a table of all users in a specific OU, then set the pwdlastSet value to 0, then after this was done, rerun the project and set the pwdlastSet attribute to 1, setting it to 1 will set it as the current date. Now, keep in mind, this was not a small company, and around 15 or so people were on the phone as I was doing this. I advised them, we will do 2 runs of this project, and also, I will log to a .CSV file all the users I edited, and what we set there pwdlastSet attribute to. After all was said and done, a 20 minute UMRA script did what took them over 300 man hours to do.

Now I hope this gives some of you out there an idea of just how fast UMRA can get or set attributes in Active Directory. But again, if you have any questions or comments, please feel free to email me, thanks again.

UMRA – Bulk Active Directory User Password Reset

2009-08-13T18:06:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail.com

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Bulk Active Directory User Password Reset

After looking through some of my blog statics I see there is a real interest in some of the Bulk UMRA Password Resets on Active Directory users. So this blog will be about the different ways you can go about resting Active Directory Passwords either in bulk, or on a one of basis. So now if you haven’t already go download User Management Resource Administrator, developed by tools4ever. This will get you up to speed with the examples and other topics I am talking about. So lets start with the basics, and answers a few questions quickly. How, fast can UMRA rest passwords. It can reset about 10 a second if now a bit more, I’ve personally done a complete active directory password reset on 5k users, and it took about ten minutes. So, as you can see UMRA is a very fast tool, in completing the tasks you need to do on Active Directory. Now below is a quick way you can update some of users in active directory passwords.

Now, keep in mind there are hundreds of way you can reset your users passwords with UMRA, and this will just go over a typical way we’ve done it for our clients. So first thing is first, the “data” now when I say “data” what does this mean, it means the data we will use to figure out who we will reset. Now, depending on what UMRA module you have, you can use different types of data. For this example though, we will just use CSV data. Now, we will assume this CSV has the usernames of the users in Active Directory you want to update. Another big decision you will have to figure out is, what do you want to set the users password to, most likely you don’t want to change them all to the same thing, so some of the things you can do are… Take an Active Directory Attribute, such as employeeid, and maybe the users lastname combine those together, and use that as the user’s new password. But also, at the same time, flag the Active Directory account to be changed upon the next successful login. So once you have your script all ready with the work flow above, or your own flow, just run one user through, or run them all through, and in minutes you’ve completed your Bulk Active Directory Password Reset.

So I hope this helps some of you out there, who might be trying to create such a script. As you can see it’s a fairly simple script to create, and really quick and easy to run.

UMRA – Get attribute (AD) Example Tips and Help

2009-08-10T18:18:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail.com

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Get attribute (AD) Example Tips and Help

If you have already read my blog about some of the basics on the Create User (AD) UMRA Action then please visit http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-action-help.html that blog to catch up to speed on this post.

Previous UMRA Action Topics.
-Move – Rename (AD)
-Remove User Group Membership
-Set User Group Memberships
-Edit User (AD)
-Get User (AD)
-Create User (AD)
-Create user (no AD)
-Edit user logon

In this blog we will be talking about the UMRA action Get attribute (AD). Now, this is one of the main actions other then Get User (AD) in the UMRA action list. The Get attribute (AD) is typically following some type of Get User (AD) or Get object (AD). Both of these action will bind to the object, so any following actions after the bind will be taken on the searched user. The whole point of the get attribute (AD) is to get an active directory attribute; this can be anything such as, dn, group memberships, and or canonical name. To get a complete list of active directory attributes, either search on Google, or yahoo for some of the best results on lists of active directory attributes. So you can use the Get attribute (AD) to grab an active directory attribute, put that into a variable, and then do something with it later in your script. An example of this would be to grade the users display name attribute, then compare this against a student information system, or csv file of what it should be, if they are different change it in active directory, if they are the same, grab another active directory attribute and compare again. So below is a quick overview of the action properties in depth.

User Object -
This by default is set to %UserObject%. To bind to the user object, see the action Get User (AD) upon successful location of a user account ,it will bind to the user that it was passed, either by user dn, or user samaccountname.

Active Directory Object -
This will need to be set to %ActiveDirectoryObject% if you plan to grab an attribute out from a group, computer, etc. something other then a userobject. If you use this you will need to clear the %UserObject% property.

LDAP attribute displayname –
This will be the attribute name you want the value of, example would be cn, canonicalname, memberof, pwdlastset, etc.

Multi-value flag -
You want to set this if the value you are getting has multiple values stored in it, such as the active directory attribute memberof, this attribute has multiple group dn’s in it.

Convert to text flag -
If you set this flag to YES, it will take the value such as a number, and put it as text.

Error if no attribute found -
If set to YES your script action will throw an error, in most cases you can turn this OFF and check the value of the output variable.

Error if empty -
This works almost the same way as the above property, you can check to make sure the value is NOT empty, if set to YES, you can set your ERROR to hope to another part in your script.

Attribute value -
This is the storage container the attribute value is stored in, so if you were looking up the display name of an active directory user, it would store it in the %AttributeValue% variable. You can switch this variablename to something more useful that fits your needs, such as %User_Displayname%.

So there you have it, a quick overview of the Get attribute (AD) action. Again, as you can see its one of the most versatile actions in UMRA. If you have any questions please feel free to email me, or leave a comment, thanks again!

UMRA – Edit user logon Example Tips and Help

2009-08-09T21:06:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail.com

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Edit user logon Example Tips and Help

Domain controller -
The variable or hard coded domain controller name. This value can be passed in with the standard %dc% variable if you have it set in Global Init File.

Password generator + password
You can create a new password for the user, and have it randomly generated based on your length, characters etc. on the fly, and it will place it in the %password% variable. Or you can just hard code a password into the password property, or make a composite password based on information passed into the script.

User must change password at next logon -
If set to YES, the user will need to change their password once they successfully login.
If set to NO, it will let the user login as normal.

User cannot change password -
If set to YES, it will not all the user to change there password.
If set to NO, user can change password.
** Note you can not have User must change password at next logon ON, and have User cannot change password set to NO.

Password never expires -
If set to YES, password for the user does not expire.
If set to NO, users password will expire if a GPO is placed on domain or OU.

Account disabled -
If set to YES, users Active Directory account is disabled.
If set to NO, users account is enabled / live in active directory

Unlock the Account -
If set to YES, it will unlock the account, if its locked because of to many failed logins.
If set to NO, it will not unlock the account in active directory

So there you have it, as you can see this UMRA action Edit user logon is very similar to other actions we’ve talked about in the past, but it combines most of the common “User Logon” features into 1 area. I hope this helps any of you out there with questions you might have had on this action.

UMRA – Create user (no AD) Example Tips and Help

2009-08-08T20:35:00.000-07:00

If you have questions email me @ mailto:jjmusicpro@hotmail?subject=UMRA%20Question

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Create user (no AD) Example Tips and Help

If you have already read my blog about some of the basics on the Create User (AD) UMRA Action then please visit http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-action-help.html that blog to catch up to speed on this post.

Previous UMRA Action Topics.
-Move – Rename (AD)
-Remove User Group Membership
-Set User Group Memberships
-Edit User (AD)
-Get User (AD)
-Create User (AD)

In this blog we will be talking about the UMRA action Create User (no AD). Now this action is very similar to the action Create User (AD) however, this action will create accounts on a local computer, comparison to Active Directory. Now this action does have the ability to create an account in Active Directory, however if you leave the %domain% variable cleared out, then it will create it on the targeted computer account, here is the quick tip in the action in UMRA.

“The name of the domain (NT4 style, e.g. PLANETS, not planets.tools4ever.com) where the account will be created. If no domain or computer is specified, the account is created on the local computer”

Now, this is a very handy tip to remember per the notes on the UMRA action Create User (no AD). Now, some of you might be asking, why would you want to create a local computer account. Simple, if you don’t have active directory, or even want to give special access to a group of users to a user base, this is a perfect way to do this in BULK, or mange those accounts on a local computer. We haven’t talked about the Edit user (no AD), and Delete user (no AD) yet, however these will help manage these type of non AD accounts. So lets get to it, below is a quick over view of some of the properties of the UMRA action Create User (no AD).

Domain -
This by default is set to %domain%, please note the quote above from this action. Setting this property can change this action completely.

Computer -
This is the computer name where the account will be created.

Name generation algorithm + Username + Full name
Now all these functions can work together, or separate, however in most cases our clients will use the Name generation algorithm to match what there current business naming algorithm is. Or example, you can take the first initial of the firstname, then lastname and combine those to make a complete username so Joe Fox, would be jfox. Now if the username is already in use, we can move to your naming iterater, such as a number on the end of the username, example would be if jfox was taken, it will now try jfox1, and jfox2…. It will keep on iterating until it finds a username that is not in use in Active Directory.

Password generator + password
Very similar to the above action, these are mostly used in conjunction with each other, if you want to create a unique password from the generator you can, and then have that pass back the %password% variable to your other functions. Or you can use a composite password comprised of info passed to the script.

These are the most properties that are used when using the UMRA action Create User (no AD). So I hope this helps some of you out there with any questions you might have had when trying to use this.

UMRA – Move – Rename (AD) Example Tips and Help

2009-08-07T21:21:00.000-07:00

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Remove User Group Memberships Example Tips and Help

If you have already read my blog about some of the basics on the Create User (AD) UMRA Action then please visit http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-action-help.html that blog to catch up to speed on this post.

In this blog we will be talking about the UMRA action Move - rename (AD). This action is another very handy action, that doesn’t get used as often as some other UMRA actions, but does quite a bit. In most cases we typically see this action used if a user moves locations such as, moving from department to department, and you have your Active Directory setup by departments. Or, most of the time we see this used in Student Information System Syncs with Active Directory. If a user moves schools, or changes grades, you can now move the student from school to school, or to another OU grade etc. Now this action is almost always used in with some form of a UMRA action Get User (AD) actions, since you will need to bind to your user first, that you want to move, or rename etc. Now keep in mind this actions is a dual purpose action, unlike some of the previous actions that we’ve talked about where they are for one active directory action, this one can move a user from OU to OU, or rename an active directory account. So below is a quick breakdown on some of the properties of the UMRA action Move - rename (AD).

User Object -
By default this is set to %UserObject%, as stated above you will need to connect or bind to an active directory user first, before you can use this action. In most cases you can use the UMRA action Get User (AD) to accomplish this.

Active Directory Object –
An %ActiveDirectory% object is almost the same as an %UserObject% except it’s based on an Active Directory object, such as group, computer etc. You can bind to an %ActiveDirectory% object by using the Get Object(AD), however we haven’t covered this in previous topics yet. However, if you take a look at the action, you see you can bind to it by the LDAP name of the object.

Organizational Unit-Container -
This will be the canonicalname path of the OU you want to place the user in, so for example WestHighSchool/Students/2011. Now keep in mind you can also move the user by the DN of the OU you want to move them to with the next below action.

OU-Container LDAP name –
Unlink moving a user by Organizational Unit-Container you can now move them with the DN of the OU, so for example OU=WestHighSchool,OU=Students,OU=……

Domain Controller -
This will be the name of your domain controller you want this action to be performed on, most of the time you will have a main INIT project with all your global variables in such as %domain%, and %dc%.

New Name –
Unlike previous actions, this one rename the account, that you are binded to. This will change the Common Name of the user account. This is the value you see when your in Active Directory searching through OU’s.

So there you have it, a quick break down of UMRA action Move - rename (AD). I hope this helps any of you out there with any questions you might have had.

UMRA – Remove User Group Memberships Example Tips and Help

2009-08-06T21:20:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail.com

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Remove User Group Memberships Example Tips and Help

Remove from universal groups -
This flag can be turned off/on. If the flag is on, it will remove any universal groups from the user in 1 pass.

Remove from security groups -
This flag can be turned off/on. If the flag is on, it will remove any security groups from the user in 1 pass.

Remove from distribution groups -
This flag can be turned off/on. If the flag is on, it will remove any distribution groups from the user in 1 pass.

Now keep in mind that you don’t have to turn off these off except one, you can mix and match these depending on what groups you want to remove from a user. In most cases that we see, the UMRA action Remove User Group Memberships (AD) will be used in some type of active directory user disable / decommission process. So I hope this helps any of you out there trying to get a little more information on how to use the UMRA action Remove User Group Memberships (AD).

UMRA – Set User Group Memberships Example Tips and Help

2009-08-05T20:48:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail.com

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Set User Group Memberships Example Tips and Help

User Object -
This should be set to %UserObject% by default. So you will need to bind to a user with UMRA action Get User (AD), and then place this script somewhere after the user bind has been established.

Group names (LDAP) -
Here one of the main Properties you will be using with this action. Here you can select your groups you want to add to the user account. Now there are 2 ways to do this, one is by setting the groups and then leaving the list as is. However, these lists can also be dynamic. So for example, say everyone who is created in your active directory, always get 2 groups, a security Group, and a Distribution Group. If you were to just select these in the selection tool, they will be hard coded, but if you select them, and edit the DN of the group to add variables, you can now make them dynamic. So if you have a group called Seattle Security, and Baltimore Security, you can pass in a variable called “%City%” into your UMRA action Set User Group Memberships (AD) table, and have it set the group on the fly. So your group dn in your table would be something like CN=%City% Security, OU=…… This is a very handy tip when trying to make your code as small, and stream lined as possible.

Group names (Pre-W2K name) –
This works almost as similar to Group names(LDAP), but as you will notice the inner table only will hold the group name, and not the group name and dn, like the previous action. Here also, you can manipulate the group names so they are dynamic, and not hardcoded.

So I hope this helps some of you out there with any questions you might have had with the UMRA action Set User Group Memberships (AD).

UMRA – Edit User (AD) Example Tips and Help

2009-08-04T21:10:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Edit User (AD) Example Tips and Help

If you have already read my blog about some of the basics on the Create User (AD) UMRA Action then please visit http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-action-help.html that blog to catch up to speed on this post.

In this blog post we are going to talk about the UMRA action Edit User (AD). This action is very similar to the UMRA action Create User (AD) in a sense that you can edit and configure many of the user objects attributes in Active Directory. But unlike the UMRA action Create User (AD) that creates a user, and then updates its attributes in Active Directory. The UMRA action Edit User (AD) Edits almost all the attributes of an existing user in Active Directory. In most scenarios you would use this action if you wanted to update a lot of attributes at once, you can use this action if you just want to set one attribute, however, it might be a little over kill since you can just use the “Set Attribute” function in UMRA. So lets get down to it and talk about some of these Property values and what they do in the UMRA action Edit User (AD).

Password generator -
If you wanted to regenerate a password for you’re the user object your binded to you can, you can also have these then sent out to the users email address to advise of new email.
More Info Can be found here > http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-password-generation.html

User must change password at next logon –
This one is self explanatory. However, if you don’t know what it does, what It does its flag the user account to be prompted to change their password upon the next successful login. This is one of the most widely used features for this UMRA action.

Account disabled -
This function if selected as “Yes” the user account will be disabled in Active Directory. If the function is selected as “No” the account will be Active in Active Directory. Now if a user Account is disabled, and you select “Yes” is will readable the account in Active Directory, and vice versa for an active account.

Account Expiration -
This function allows you to set a date, either by a generated date with UMRA or a hard coded date to know when the account will be expired in Active Directory.

The rest of the functions are your basic User Object attributes, such as email, description, phone number etc. I hope this helps some of you out there get a better idea of what the UMRA action Edit User (AD) does, and some of its features.

UMRA – Get User (AD) Example Tips and Help

2009-08-03T19:50:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Get User (AD) Example Tips and Help

If you have already read my blog about some of the basics on the Create User (AD) UMRA Action then please visit http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-action-help.html that blog to catch up to speed on this post.

In this blog post we will be coving the UMRA action Get User (AD). We will talk about some of the features, and tips of using the action, plus talk about how it’s one of the main actions you will be using in most of your UMRA scripts. So, first I will talk about what this action does. The Get User (AD) action binds to a user object in Active Directory. Bind you ask? Yes, when I say bind, it means that any actions in your script that are executed against the %userobject% variable, will happen to the user you binded to. How do you set the %userobject% variable? This is simple, as long as you bind to a user object either by full name example (Joe Fox), username example (joefox67), or user dn example (CN=Joe Fox,OU=High School,OU=…) you can set the %userobject% variable within your UMRA script script.

So here is a quick tip on how to really bring out true functionally in your UMRA Get User (AD) action. In most cases you can bind right to the user object with there username, or samaccountname. However, in some cases you might have to do a search in Active Directory for an employeeID, or some other unique identifier, since you might not know the user objects username. So you can use the “Search Object (AD)” UMRA action to search for a user with an Active Directory attribute that equals some criteria, if it finds a user that meets your criteria, then it will store the users dn, in %searchresults% variable, this variable can then be passed to your Get User (AD) action. This is just one of the many ways you can daisy chain your UMRA actions to work for you.

So I hope this helps any of you out there trying to figure out some of the ways to use the UMRA action Get User(AD).

UMRA – Create User (AD) Password Generation Example

2009-08-02T11:36:00.000-07:00

If you have questions email me @ jjmusicpro@hotmail

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Create User (AD) Password Generation Example

If you have already read my blog about some of the basics on the Create User (AD) UMRA Action then please visit http://activedirectoryadmin.blogspot.com/2009/08/umra-create-user-ad-action-help.html that blog to catch up to speed on this post.

So if you’ve been following along since my last blog, you will know that we are going over some to the Property values in the Create User (AD) UMRA action. We have already covered ways to set the user creation point, and also the UMRA naming algorithm that you can set to whatever you like. So in this post we will be covering on the Password Generation action in the properties menu. What is the password generation property you ask? Well, it allows for passwords to be randomly on the fly, based on the length, input that you put in. Now there are a few ways that you can set a new users password in active directory upon creation, one way is to take a combination of data, such as there lastname, and there employee or student id, combine this data, and have that as their initial password, and then flag there account to change it upon the next successful login. The other method we will talk about below.

So if you want to set your password as something randomly created on the fly, that meets your active directory password complexity, then use the password generation property within the create user action. With this tool, you can now create passwords on the fly, when you open up the property, you can set the length of the randomly created password, and you can set how much lowercase letters you need, uppercase, numbers, special characters etc. Once you’ve set everything, you can hit the text button, and see the passwords that is creating. As you can see this process is very simple, but yet one of the most powerful tools within the create user action. Now some of you might be asking, “once we create the account, how will I know what the password is?” There are a few ways of doing this, within UMRA there are some actions that allow you to write data to a text file, update a database, or even send an email with this data. In most cases of UMRA Automation projects we do, our clients will have us email the username and password that was used with creating the account, this way they will always have this on hand when a new user is created.

So I hope these last 2 blogs have helped some of you out there with the UMRA action Create User (AD). In later posts we will talk more about the different actions with UMRA at an deeper glance to help you further understand UMRA a bit better.

UMRA – Create User (AD) Action Help Examples and Tips

2009-08-02T11:21:00.000-07:00

UMRA – Create User (AD) Action Help Examples and Tips

So we are going to be getting back to the basics of UMRA and how some of the drag/drop items work. I will be coving at first some of the basics such as Create User, Get User, and other User Tree actions in UMRA. Now, most of you will be using the “Create User” action in your UMRA scripts but might need a little explanation of some of the property values you can set when creating a user. The “Create User” action is one of the most widely used, and one of the most versatile actions on the list, so with that said let’s get into the details of this action.

So for the sake of time, I will only cover some of the Property values in the Create User action that really have a lot of weight on the Creation of the User, and have the most flexibility in integration into your script.

Now when creating a user there are two ways you can set where the user is created, by the DistiniguistedName or canonicalname of the OU they need to go in.

Organization Unit-Container –
Here you will need to define the DistinguishedName of the OU, so for example OU=2012,OU=Students,OU=East HighSchool,… etc.

LDAP Container -
Here you can specific the canonicalname of the container so for example mydomain.local/Schools/East HighSchool/Students/2012

For me I prefer to use the LDAP Container method since it’s easier to understand, and allows for less errors due to having to create a full dn for placement.

Right now I would assume you use some type of naming convention for your students, or staff, or any type of active directory user such as jfox, of 23424. With UMRA you have the Name Generation Algorithm method available to you, IF you want to use it. If you don’t want to use it, and you know that your ID’s will be unique, then you can bypass this feature, however if you want to use this, you will see there are a ton of options for this.

Name Generation Algorithm -
There are a few ways you can do this, for example if you want to take the firstname and lastname from a CSV or from a database, and combine those to make the username you can, but sometimes you might find that you have a jsmith already in use in your Active Directory, so what do you do? You can use the Name Generation Algorithm within your UMRA Create User action. This feature is very handy since it will check to make sure the name you’ve created is already in use, and if it is, do some type of iteration. This iteration can be adding a number at the end of the username, or getting the middle initial of the user, and add that to there username.

So as you can see these are just 2 of the over 40 actions and properties you can set when you are using the Create user (AD) action in UMRA. In my next post I will talk about other features of this action.

UMRA – Automation MASS Forms and Delegation

2009-08-02T10:14:00.001-07:00

If you have questions email me @ mailto:jjmusicpro@hotmail?subject=UMRA%20Question

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Automation MASS Forms and Delegation

In most of my blogs I talk about ways you can do different tasks in your Active Directory environment with UMRA. These different tasks actually can be completed in many different ways within the UMRA software however, in this blog I am going to break down the different modules in UMRA to give you a better idea of what it is that will fit and work with your project a little better. Now, in most of my blogs, my example projects consist of those of you who use UMRA Automation or UMRA MASS. Most of my examples for UMRA Forms and Delegation I like to do on the web, instead of using the built in Forms and Delegation client within UMRA. So below I will break down at a very high level of what each of the different modules do.

UMRA – Automation Module

UMRA Automation is very similar to the UMRA MASS module however UMRA Automation you have the ability to put your scripts on a schedule. Schedule you might be asking? Yes, you can have your script run on a specific interval, example would be to have your script run every hour, day, or week. This is extremely helpful when you’re doing a sync with your student information system SIS to active directory. You can now read your SIS every hour, and make sure new users are created, or status changes reflected down to Active Directory. Also, when you get the UMRA Automation you get full use of the UMRA COM Object. The UMRA COM Object is a .dll file that is packed with methods and functions to call UMRA from a remote application such as a web page. Form more information on this, please see my other blog: http://umratips.blogspot.com/

UMRA – MASS Module

UMRA MASS is very similar to the UMRA Automation module however instead of being able to schedule your UMRA projects to run on an hourly, daily, monthly basis etc. Your scripts are now executed on a “one by one” basis, so you will have to manually go in and execute a your script when you want it to run. That is the biggest difference between the two, there are a few other differences, but that is the biggest one.

UMRA – Forms and Delegation Module

UMRA Forms and Delegation module is very different from the UMRA MASS and UMRA Automation modules, they however use the same drag/drop script logic for behind the screens processing, but now allow for a user form to be created for imput. So for example you can make a simple form that the end user types in a firstname, lastname, and maybe picks a location from a list, and hits a “Create User” button. This button would take those inputs from the client and use those values for your UMRA script.

So as you can see UMRA is a very handy tool when it comes to handing your Active Directory needs, and no matter what you need to do, it can handle it with one of the available modules.

UMRA – TIES SIS Active Directory Student Automation

2009-07-29T21:19:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – TIES SIS Active Directory Student Automation

TIES, is another popular Student Information System (SIS) our clients want to get an automatic sync with UMRA Automation to Active Directory (AD). Sync you ask? Yes, UMRA Automation can connect to the TIES Student Information System in multiple ways. In most cases, we are able to do a direct ODBC database connection, and either through a view, or custom query string, we can get all students, and there information. From this information, we are able to compare this data agsinsts whats in Active Directory. This process can be put on automated schedule, to run every hour, day, week etc. in most cases we see our clients run this nightly to make sure the data in Active Directory is in sync with TIES Now, in some cases you might not have your TIES SIS hosted on your network, it might be hosted somewhere else. This is ok, most of the time, these companies will create you a view in the TIES SIS you can call from within UMRA Automation project, with read only access. Or, they can provide you with a nightly CSV data dump. Either way, UMRA Automation can handle all of these different type of data retrieval types. So what can you sync, I bet is the next question you might be asking. UMRA Automation can really sync up any data that is provided in your database view, check student graduation years, student locations, student first name, last name, group memberships etc. Below is a quick overview of how a typical TIES Student Information Sync works.

Step 1
Get your data. As stated above this can be multiple ways, CSV, View from the database, etc. In most cases if your TIES SIS is hosted with you, you can connect directly to the database, and create yourself a view, or combine a bunch of tables together with joins until you get the data you need.

Step 2
With a UMRA Automation project, create a loop to check all the users in your data source checking for only new accounts. You can do this by checking for the student ID, or your identifier, if that is in AD go to the next record, if it’s a new record that needs to be in AD, create the account, create a home folder, create a profile path, create an email account, etc.

Step 3
With another UMRA Automation project, get all the student accounts in Active Directory and run them against the data source of students. If a user is in AD and in your SIS, then run a compare, check firstname, lastname, location etc. If a user is not in the right location, or grade move the account. Strip group membership; reapply group memberships based on new location, move home drives, and email mail stores if needed.

Step 4
Now that you have your main projects done, you can now go back and add logging / auditing into your scripts. Most of the time I will save these until last, however you can also do these while creating your other scripts to speed up the process. Why would you need logging you might ask? Anytime your script edits an object in AD, it could be a create user, move user, updating / changing an attribute, you will want to keep a history of this, that way you can go back a few months from now, and see the history of changes etc. to your users and objects in active directory.

Step 5
Now that you have all your processes really, create 1 main UMRA Automation project to call your smaller projects in succession. Dont forget to take out any starter projects such as INIT projects that have global variables in them, since you wont need to call these projects except for 1 time in the begginging of ryour run.

I hope this gives some of you out there an idea of how to get your students from TIES into Active Directory.

UMRA – Powerschool Database Data Export to Active Directory

2009-07-18T20:11:00.000-07:00

Contact Me: mailto:jjmusicpro@hotmail.com?subject=UMRA Question

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

PowerSchool Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-powercampus-erp-active-directory.html

Destiny Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-destiny-sis-active-directory.html

Zangle Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-zangle-sis-active-directory.html

Aeires Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-aeries-sis-active-directory.html

UMRA – Powerschool Database Data Export to Active Directory

I’ve been taking a glance over some of my key words for my blog and I see of my major traffic is based on the Popular Student Information System SIS PowerSchool. Digging deep, I see that my users are very interested in getting the data from the PowerSchool Database to Active Directory. So in this blog post I will give you a quick rundown on the different ways of getting this process started.

So first thing is first, if you haven’t already you will need to download UMRA since this will be our main SIS automation tool. This will allow us to connect to the PowerSchool SIS Database, or allow you to get a CSV data dump of PowerSchool Students, and import that into Active Directory. Now, depending on if your PowerSchool SIS database is hosted internally within your network and you have control of it, or if your PowerSchool SIS database is hosted with a hosting company, the below methods will change.

If you can Connect Directly or Remotly to PowerSchool Database -
Create a UMRA Automation Project and within this project, you will need to drag/drop 1 “Generate Generic Table” action to your main script, this will be your main connector to your PowerSchool Database. Now go through the normal database connection steps as you’ve done before when creating a generic table. For the SQL query, you can either create a view to only grab the information you need from PowerSchool, or you can write a complex SQL statement to join together all the tables needed.

If you can’t Connect Directly to PowerSchool Database -
In this case you will need to create a UMRA MASS Project, since you will most likely be getting a CSV of data from the PowerSchool DB.

Ok now that we have our connect setup, the next step will be very the same, since each script weather its an UMRA Automation Project or UMRA MASS Project. So now that you have your data, you now need to create your script for student creation. Now keep in mind that UMRA has the ability to create OU’s Groups etc. So if needed you can create these on the fly, the same time you are creating your students. So first thing is first, you will need to make sure the student is not in Active Directory already, you can do a “search object AD” for this. If they are not in Active Directory lets create the account. After you’ve created the account, you can now move them to the correct location, or create the student account in the correct OU right when you create them, this is the most typical approach. After you have created the account, now you can create email accounts, home folders etc. And that’s it, a quick way to get connected to your PowerSchool Database or CSV and get those users in Active Directory.

UMRA – MASS CSV Create User Data to Active Directory

2009-07-17T20:09:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – MASS CSV Create User Data to Active Directory

This blog is going to be a different approach on how to use UMRA to do a UMRA MASS Create User from a Microsoft Excel CSV file. As you know, most of the topics I’ve covered are using the UMRA Automation module to automate user creation, user comparison, etc. So if you haven’t already taken a look at how to automate your student information system such as PowerSchool, Destiny, Zangle, Aeries etc. see the below blogs>

PowerSchool Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-powercampus-erp-active-directory.html

Destiny Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-destiny-sis-active-directory.html

Zangle Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-zangle-sis-active-directory.html

Aeires Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-aeries-sis-active-directory.html

So again, if you haven’t already checked out the above blogs, you should so you can get an idea of how you go about using UMRA Automation to automate your Student Information Sync to Active Directory. Ok, so back to the topic of doing a UMRA MASS import of users from a CSV to Active Directory. So below I will give you some tips of how you can achieve this process with your CSV of userdata.

Step 1
The more information the better. So the more userdata you can get in your CSV, the more flexible your script can be.

Step 2
Before you start working on your script, think about what is your trying to accomplish, are you only creating user accounts, or will you be creating home/profile folders, email, group permission etc. If you’re going to just create student accounts, then you can do more than just putting all the account into one OU then sorting them later. With UMRA MASS you have the ability to create users in specific OU’s if you have data the corresponds to where they should be in Active Directory.

Example
CSV Data might have School and Grade columns, so you can map where you create the user like this. OU=%Grade%,OU=%School%,OU=….
This can be placed into your create user, so for each record it will take the CSV data and dynamically place your records data into those variables, and create the user in that OU dynamically!

Step 3
After your users are created, you can now take any other steps needed when you provision your accounts in Active Directory. This can vary from group membership, home folder creation, email create etc.

So I hope this helps some of you out there who might be trying to look for a way to do a UMRA MASS import of users into your Active Directory Environment. The steps above only really cover just a fraction of what UMRA can do, for more information on more functions see my other blogs, or visit the tools4ever.com website.

UMRA – PowerCAMPUS ERP Active Directory Student Automation

2009-07-16T18:40:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – PowerCAMPUS ERP Active Directory Student Automation

PowerCAMPUS Student Information System is one of the major leaders in helping schools manage their students, in a friendly fashion. However, like most Student Information Systems (SIS) they are great for the initial roll out of students, but when student accounts need to be created, updated, or managed on a daily basis there is no link to Active Directory, Exchange, Home Folders, etc. That is where UMRA Student Automation comes into play and bridges that gap, without the need of extra IT staff, or manage the students information. So, the typical UMRA Student Automation projects do for our clients can range from MASS import from PowerCAMPUS to Active Directory, this can involve, creation of student accounts, creation of home folders, setting security on those home folders, creating exchange 2000 2003 2007 email account, and all doing this in one big sweep. But UMRA Student Automation doesn’t stop there, often your PowerCAMPUS SIS is updated on a daily basies, so how can you ensure that if a student were to move schools, withdraw, or change names that these are reflected down to Active Directory in a timely manner? UMRA can handle that, yes you heard it right. UMRA not only has the ability to do MASS imports, exports, updates. But UMRA also has the ability to connect to your PowerCAMPUS SIS, get all the students, and check this information against Active Directory. UMRA will ensure that the students who need to be in active directory are, move student who have changed locations etc. So as you can see, UMRA Student Automation is one of the best and most flexible ways to get your students from PowerCAMPUS into AD, and then manage those students information on a hourly, nightly, etc. basis. Now, I know some of you might be asking what are the limitations of UMRA Student Automation projects. Now, that’s a tuff question to answer, since UMRA has the ability to create, edit, modify, move any active directory object, the possibilities are endless. Below is a quick overview of how UMRA can handle student account changes.

Student Moves Schools (Example Work Flow Process)
Student Moves Schools From Seattle To Federal Way High School (Updated In PowerCAMPUS SIS)
>Strip Current Group Memberships
>Reapply Correct Group Memberships for new school and courses
>Move Home/Profile Folders to new file server and reset security permissions
> Move exchange mail box from one mail store to another
> Move account from old OU to new OU
> Log All changes to Account to a Access, MSSQL, MYSQL etc. database
> (Optional) Email changes to Staff as FYI

New Student in PowerCAMPUS ERP System (Example Work Flow Process)
> Create New Account, username can be unique ID such as Student ID
> Set Group Memberships based on school location in PowerCAMPUS
> Create Exchange Mailbox or Hotmail or Gmail Email with an API
> Create Home/Profile Folders and setup security on those folders, these can be mapped also, so based on the students school location in PowerCAMPUS, you can have the home/profile folder created on a specific server.
> Email users information to HomeRoom Teacher, or Add data to a staging Database for School clerk to have on hand.

Student Move Up Grade(s)
> Move Student Account From Old Schools OU to New Schools OU (This can even be Grade)
> Strip Group Memberships
> Change Description or other AD attributes that may contain grade or student information
> Reapply Group Memberships based on New Schools OU
> Move Home/Profile Folders to new shares
> Move Email Mailstore from one exchange mailstore to another

Student Graduates
> Move Student to Archive OU
> Strip Group Memberships, and maybe add user to “Alumni YYYY” Group
> Move Users Home Folder to Secure Admin Share
> Download users mail store to .PST File, and put that into home folder.
> Time/Date stamp the account with current date when student account became marked as Graduated in PowerCAMPUS
> Have another UMRA Student Automation project check these dates and if over xx amount of days, you can delete the account from Active Directory.

Above is just a quick overview of one of the many ways you can really take control of your PowerCAMPUS UMRA Student Automation project. These changes will happen all behind the scenes on your specific interval. No need to manually do all these processes by hand anymore. As you can see UMRA has the ability to take the manual tasks you did on student account, and take your logic and work flows you did on those accounts, and put them into an automated processes., So if you haven’t already downloaded the trial version of UMRA do so, so you can see how it can benefit your PowerCAMPUS SIS.

UMRA – Destiny SIS Active Directory Student Automation

2009-07-15T19:57:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Destiny SIS Active Directory Student Automation

Destiny Student Information System is one of the major leaders in helping schools manage their students, in a friendly fashion. However, like most Student Information Systems (SIS) they are great for the initial roll out of students, but when student accounts need to be created, updated, or managed on a daily basis there is no link to Active Directory, Exchange, Home Folders, etc. That is where UMRA Student Automation comes into play and bridges that gap, without the need of extra IT staff, or manage the students information. So, the typical UMRA Student Automation projects do for our clients can range from MASS import from Destiny to Active Directory, this can involve, creation of student accounts, creation of home folders, setting security on those home folders, creating exchange 2000 2003 2007 email account, and all doing this in one big sweep. But UMRA Student Automation doesn’t stop there, often your Destiny SIS is updated on a daily basies, so how can you ensure that if a student were to move schools, withdraw, or change names that these are reflected down to Active Directory in a timely manner? UMRA can handle that, yes you heard it right. UMRA not only has the ability to do MASS imports, exports, updates. But UMRA also has the ability to connect to your Destiny SIS, get all the students, and check this information against Active Directory. UMRA will ensure that the students who need to be in active directory are, move student who have changed locations etc. So as you can see, UMRA Student Automation is one of the best and most flexible ways to get your students from Destiny into AD, and then manage those students information on a hourly, nightly, etc. basis. Now, I know some of you might be asking what are the limitations of UMRA Student Automation projects. Now, that’s a tuff question to answer, since UMRA has the ability to create, edit, modify, move any active directory object, the possibilities are endless. Below is a quick overview of how UMRA can handle student account changes.

Student Moves Schools (Example Work Flow Process)
Student Moves Schools From Seattle To Federal Way High School (Updated In Destiny SIS)
>Strip Current Group Memberships
>Reapply Correct Group Memberships for new school and cources
>Move Home/Profile Folders to new file server and reset security permissions
>Move exchange mail box from one mailstore to another
>Move account from old OU to new OU
>Log All changes to Account to a Access, MSSQL, MYSQL etc. database
>(Optional) Email changes to Staff as FYI

Above is just a quick overview of one of the many ways you can really take control of your UMRA Student Automation project. These changes will happen all behind the scenes on your specific interval. No need to manually do all these processes by hand anymore. So if you haven’t already downloaded the trial version of UMRA do so, so you can see how it can benefit your Destiny SIS.

UMRA – Zangle SIS Active Directory Student Automation

2009-07-13T20:27:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA> http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Zangle SIS Active Directory Student Automation

Zangle, is another popular Student Information System (SIS) our clients want to get an automatic sync with UMRA Automation to Active Directory (AD). Sync you ask? Yes, UMRA Automation can connect to the Zangle Student Information System in multiple ways. In most cases, we are able to do a direct ODBC database connection, and either through a view, or custom query string, we can get all students, and there information. From this information, we are able to compare this data agsinsts whats in Active Directory. This process can be put on automated schedule, to run every hour, day, week etc. in most cases we see our clients run this nightly to make sure the data in Active Directory is in sync with Zangle Now, in some cases you might not have your Zangle SIS hosted on your network, it might be hosted somewhere else. This is ok, most of the time, these companies will create you a view in the Zangle SIS you can call from within UMRA Automation project, with read only access. Or, they can provide you with a nightly CSV data dump. Either way, UMRA Automation can handle all of these different type of data retrieval types. So what can you sync, I bet is the next question you might be asking. UMRA Automation can really sync up any data that is provided in your database view, check student graduation years, student locations, student first name, last name, group memberships etc. Below is a quick overview of how a typical Zangle Student Information Sync works.

Step 1
Get your data. As stated above this can be multiple ways, CSV, View from the database, etc.

Step 2
With a UMRA Automation project, create a loop to check all the users in your data source checking for only new accounts. You can do this by checking for the student ID, or your identifier, if that is in AD go to the next record, if it’s a new record that needs to be in AD, create the account, create a home folder, create a profile path, create an email account, etc.

Step 3
With another UMRA Automation project, get all the student accounts in Active Directory and run them against the data source of students. If a user is in AD and in your SIS, then run a compare, check firstname, lastname, location etc. If a user is not in the right location, or grade move the account. Strip group membership; reapply group memberships based on new location, move home drives, and email mail stores if needed.

Step 4
Now that you have all your processes really, create 1 main UMRA Automation project to call your smaller projects in succession.

I hope this gives some of you out there an idea of how to get your students from Zangle into Active Directory.

UMRA – Active Directory Automation Error Handling

2009-07-07T20:17:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Active Directory Automation Error Handling

By now after reading and following my posts you should have some idea of how to create a
UMRA Automation project to automate student or staff account creation, or running account audits on your Active Directory. Now, we all know that your UMRA Automation projects sometimes will throw errors for different reasons, and depending on how many accounts or Active Directory objects you are trying to provision, your UMRA Automation logs can get quite large. I often find myself sometimes, running a UMRA Automation project that handles over 20k student accounts, and wont know if the UMRA Automation project threw and error until it is completely done, thus having four or five UMRA log files to search through, make this a little tuff sometimes, to figure out where it threw and error and why. So in this blog I will talk about ways to step up your UMRA projects to include some error handling, to show you what UMRA Automation project actually threw the error, and any other information in that script.

UMRA – AD Automation Error Handling How To
So I will keep this at a high level so you can get an idea of how you can take this UMRA Automation Error Handling and Error Logic and integrate it into other projects you might have.
What I will do is first create two non script items in my UMRA Automation project, one will be called “Error” the other is “No Error” within the 2 no action items, you will drag and drop a “Export Variables” action, this action will export to a file either on your desktop, or folder somewhere, the UMRA Automation project name, and then any variables you want to during and error. So for example if you have a project called “Student Creation” You can export the name, and maybe a studentid, or accountname when you throw this error, this way you can look into the account, or action and figure out what is going on. Now, you take this same approach on all the UMRA Automation projects you build, and now when you run your larger projects, you will have log file of what UMRA Automation projects threw and error, who it was on, and a even a datetime of when they happened.

Below is a quick screen show of how you can implement this UMRA Automation Error Handling into your projects.

UMRA – Student Information System Automation SIS

2009-07-05T18:05:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Student Information System Automation SIS

In my previous blog post’s I’ve talked about ways to setup a set of UMRA Automation projects to automate the creation, editing, etc of student accounts and or other Active Directory objects. The 2 main Student Information Systems I’ve covered are Aeries SIS and PowerSchool SIS. Both of these are very popular Student management systems. If you haven’t already please take a look at how you would setup such a UMRA Automation project to sync up either Aeries or Powerschool to Active Directory. Now if you reading this blog post and you haven’t seen some of my others, please take a look to see how flexable UMRA really is. However, for this blog post, keep In mind that UMRA Automation has the ability to sync up with your Student Information System, and provision your student accounts, everything from account creation, student moves, group memberships, home folder moves, home folder creations, active directory attribute changes or updates, email creation, and really any other work flow you might have for student accounts.

Aeries Student Information System Sync:
http://activedirectoryadmin.blogspot.com/2009/07/umra-aeries-sis-active-directory.html

PowerSchool Student Information System Sync:
http://activedirectoryadmin.blogspot.com/2009/05/umra-power-school-active-directory-sync.html

Now in both of those posts, I talk about if you have access to the student data directly, however in some cases, you might not have direct access to the Student Information Systems SIS data. Int his case, you can see if your provider will allow you to get a daily download or CSV for data to work from. This approach is most used if you are not hosting your own SIS, and you are doing off campus hosting. Now in the case you might not have the option to download a CSV of student data, you can ask your data provider if they will provide you with a view you can work from.

This was just a quick blog to show there are multiple way to get your Student Information System Sycd up to Active Directory with UMRA Automation.

UMRA – Aeries SIS Active Directory Automation

2009-07-05T11:32:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Aeries SIS Active Directory Automation

Aeries Student Information System (SIS) is one of many Student managing systems high schools, middle schools, and other colleges use to mange there students in there schools. One of the benefits of using such a system is having one central place to manage your student’s information on a yearly basis. However, when it comes to a new school year, or updates in your student information system, sometimes it’s a hard and tedious task to update our Active Directory with these changes. These are the challenges our clients face with they are using the Aeries SIS and need to create new student accounts, with special group permissions, home drives, profile path, even exchange, Google, or hotmail accounts. Setting up these accounts each year can take weeks, however using UMRA Automation you can now have any changes in your Aeries SIS replicated out to Active Directory on a daily, hourly, etc basis. What do I mean you ask? Simple, with UMRA Automation you can now either take a snap shot of the all the students status in Aeries, and then compare that against Active Directory. So for example, if your Aeries SIS just updated Joe Fox’s first name to Joey, when you run your UMRA Automation it will now see that in Active Directory, Joe Fox’s first name is Joe, however in the Aeries SIS its Joey, and UMRA Automation will update that active Directory account. Now, this is an example of a simple attribute change, UMRA Automation can look at any aspect of the Students Active Directory account. So you can check grade level, group memberships, home folder status etc. If any of this is different then whats in your Aeries SIS, then UMRA Automation can now move the student, update the student etc. Below is a quick way to get this process started.

UMRA – Aeries SIS Active Directory Automation How To

To get this process started first you will need to download the trial version of UMRA > http://www.tools4ever.com/download/. Once you have that downloaded, lets get everything started. Below are some very high level steps on how this process goes.

Step 1:
You will need to create a view of all students in your Aeries Student Information System.

Step 2:
Create a new UMRA Automation Script this script should connect to this view with a Gerneric Table action. You will then loop through this table, and update your SQL temp holding table with. Once this is done, you can now put this script on a hourly, daily, weekly basis to grab your Aeries view, and update your SQL database with the latest.

Step 3:
With another UMRA Automation Script you will now check all records in your Temp SQL if there are records in the database that are “active” and there is no student account in Active Directory, you script should create that account. Then on the flip side, if there is an account in active directory, that is in your Aeries SIS, then run a compare on that account, check firstame, lastname, grade, school, location, etc.

So I hope this give some of you an idea out there of how this process would work with getting your Aeries Student Information system on an automated schedule to provision and create student accounts.

Blog update - July 25th 2009
So I've decieded to go back through some of my old blogs and update them with a little more information now some of the details on these Student Information System SIS Autiomation syncs with Active Directory. Most of the time, I will give you a quick overview of how these work at a very high level, since there are many details on the lower level scripts that doe the work. So In each of my SIS connectors for Active Directory I will be going in detail on the connection to the database, and the different methods I've seen for each, as well as give you a good idea of what you will need for data when you are trying to sync up your SIS with AD. So lets get down to some details.. Now most of the time with we use UMRA for our automation projects, the data of the students or staff is always the most critical, since withouth this data we really dont have anything to sync up. Now, I've seen 2 scenarios mostly in my deployments, one is that the client already has students in active directory, and one where there are no students in active directory. If the users has students in active directory, make sure you check first to see how those students are related to the Aeries SIS system. Now, sometimes we get lucky where the ID of the student (samaccountname / login name) is the student ID created by aeiries, or there is an uniuqe identifer in the acccount somewhere, maybe employeeid. Why is this so vital? Well, if the students are already in Active Directory, you are half way done, all you will need to do is link up the students data in your data, and then bind to that user by the attribute in Active Directory. Now, if the client doesnt have this link, then you will need to either have them create these, and add them to an account, or run a UMRA to find the students and add these ID's to the accounts. Now the only problem with this is...how can you be certain the "Joe Fox" in your SIS, is the same "Joe Fox" in your Active Directory? In most cases like this we just end up recreating the accoutns with unique ID's or linking as much data as we can on the account, before we actually run an update with UMRA. In most cases, we typicaly get a "SQL View" to get a dataset directly from the Aeries SIS sytem, if we dont get a View, then you can contct your Aeireis Datbase hoster, and ask them to give you a daily CSV dump of your students and there information. Here is a quick list of items we typically get in your view, with this data UMRA should be able to run a sync smoothly. StudentID, FirstName, LastName, Status, School,Grade,AUP. StudentID is self explanitory, this is the studentid that is generated by the Aeries system, you can use this as there account / login name of active directory, since these are unique, there will be no duplication issues. First Name and Last Name will be added to the account, so both of these are straight forward. Status, will be there current status, "w" for withdrawn, "a" for an active live student, and "g" for graduated, somttimes these will be mapped to the exact type, but if they provide single letter you now know what they stand for. So next will be school, this will be the school they attend, this can come as the complete school name, or the 3 letter prefix. Grade will be the grade of the student. AUP is typically if they have a internet use policy, or network policy form signed, if this is set to "y" or "n" then you will give them a specific group membership to allow internet etc. This are the most comon fields that i see when we are given data in a view to work with. Now keep in mind this is some of the basics of the data, sometimes you can get more depending on what you wnat to do with your sync.

UMRA – SSRPM User Auto Enrollment

2009-06-12T21:05:00.000-07:00

UMRA – SSRPM User Auto Enrollment

If you haven’t already read about all the very handy things you can do with SSRPM via a custom UMRA Web Portal, then check out my blog post here: http://umratips.blogspot.com/. Ok, so I was recently tasked with helping one of clients Auto Enroll all of their users in Active Directory into Self Service Reset Password Manager (SSRPM for Shot). SSRPM unfortunately does not have this feature in any current release, however maybe in later version it might. SO for now, I had to find out a way to loop through all the users in Active Directory, and use details in the user accounts, and enter these into the users SSRPM questions for their answers. There is no real easy task for this procedure, and you want to make sure that if you take this approach you are very careful with how you do this, since it can corrupt your complete SSRPM environment, and you will be forced completely wipe, and reinstall SSRPM. So I will go over at a high level some of the things to watch for, and tips that I found when doing this Auto Enrollment.

UMRA – SSRPM User Auto Enrollment How To

As I’ve stated in the previous topic, please be take precautions when doing this type of Auto Enrollment. Now there are a few things to take into consideration before we get started, for the quickest and most reliable way to have users Auto Enrolled into SSRPM, I use UMRA to do this. Since UMRA has the ability to schedule scripts to run on a specific schedule, this is the perfect tool to check for any new users added to Active Directory. Also, keep in mind, this SSRPM Auto Enrollment, won’t be a 1 time check, this will be a continual check of users in Active Directory Against users who should be enrolled, if a user is brand new in active directory but not in SSRPM then we enroll them. So below are some of very high level steps that you can take to get a process like this working.

Step 1: Set up your SSRPM to use mandatory questions, and set up your profile(s)
Step 2: Make sure the accounts in Active Directory have the related data in attributes in their account.
Step 3: Create a New UMRA Automation Project, this project will get a table of all users, except users who are part of “Domain Admins”, or you can do a check on the user’s group memberships, and skip over users who have this group. Or, filter your table to fit your SSRPM Profile(s) needs.
Step 4: In your UMRA Automation Project you just created, lop through that table with a “For Each” action, with in your other UMRA Automation Project make sure you check for any blank values of the required SSRPM questions. If any of the required questions are blank, have no value, or anything else that is considered no valid, either email a user group, yourself, or even write these users out to a text file using the “Export Variables” action.
Step 5: Now that you have your script setup, now put your UMRA Automation Project on a scheduler. This can be setup for hourly, daily, monthly etc. In my scenario, I had this run every hour to check Active Directory for new users.

I hope this helps out some of you who are trying to Auto Enroll Users Into SSRPM. If you have any questions, or comments please email me or leave a comment.

UMRA – Power School Active Directory Sync

2009-05-17T19:42:00.000-07:00

UMRA – Power School Active Directory Sync

Just recently I was tasked with taking colleges current Student Information System (SIS) and have that data replicated and synced up with their current Active Directory Structure. Most of you know this is no easy task, making sure names, locations; home folders, exchange emails, and other downstream systems were all in sync. However, with UMRA – Automation module this task is possible, however without UMRA this task could take days, if not multiple months to finish. Now this sync, included more then just firstname and lastname checks, I had to do the complete check on the actual user account, and other objects in AD. Other objects you ask? Yes, I also had to create groups, and OU’s on the fly. Since each student was added to a group based on their current enrolled curriculum. So in this blog post I will go over how to get your information lined up, and what hurdles I had to cross before I was able to get this project finished up.

UMRA – Power School SIS Pre Work

So before we even get started on the UMRA – Automation sync to Power School, we need to find out how we are going to obtain our data. In some cases, we are not allowed to connect directly to a Database, and run our quires on it. In my case I was only giving a view of data, that I had to work with. Below is a quick diagram and some tip’s of how you can use your view to create a virtual SQL Database of the Power School Student Information System (SIS).Get Database view from Power School> Use UMRA to pull SQL View From Power School, and loop through that table to insert records into your virtual SQL Database.Now that we have the Power School Student Information System data in a database, you can now have a UMRA project grab that data, and loop through it. What the benefit doing that compared to just grabbing the data right from the SQL view? The benefit of putting it into another database is, now you can add you own columns and other requirements that you may need with running your UMRA – Automation project, that are not originally in your SQL View from Power School.So the next step would be to diagram out what you’re going to do when certain scenarios arise. See below for a few examples.

Work Flows and Custom Processes Examples
Student is Active in Power School But not in active directory – You can do multiple things here, create the account, maybe put the data into a “staging database” and have some type of customer webpage to show you who needs to be created.
Student is Active in Power School But Account in Active Directory is Disabled – Here you can do multiple things again, maybe read group memberships based on some data in the SQL database, move the account etc.

Those were just a few of the scenarios that you can run into when doing this type of UMRA – Automation with Power School. So now that you have all your diagram laid out, create your scripts, and put your script(s) on a custom schedule, and your ready to go.

UMRA – Microsoft Exchange 2000/2003

2009-05-07T22:09:00.000-07:00

UMRA – Microsoft Exchange 2000/2003

Most Active Directory environments will use Microsoft Exchange 2000/2003/2007 for email services for their users. Creating, Managing and Editing these accounts is a daunting task, and sometimes requires an in-depth knowledge of these systems to create a simple email for a user. However, with UMRA this tasks becomes very easy to do, and creates email accounts with complete uniformity. For this blog we will focus on UMRA’s ability to do tasks on 2000/2003 Exchange, we will get into 2007 in another post. Below is a screen shot of some of the built in actions that UMRA has for managing Exchange Mailbox’s.

UMRA – Microsoft Exchange 2000/2003 Actions

> Create Exchange mailbox
> Edit Exchange mailbox
> Modify Exchange mailbox
> Move Exchange mailbox
> Delete Exchange mailbox
> Manage Exchange recipient mail addresses

UMRA – Microsoft Exchange 2000/2003 Tips

Most of our clients we build UMRA – Automation Scripts for have multiple Exchange Mail stores, either for different types of users, or different locations. So how can UMRA know where create these Exchange Mailbox’s at? Simple, UMRA has the ability to Create “Mapping Tables” to compare data that you send your UMRA script. So for example, if you have CSV or Database data that you’re working with, you can use a column of data determine the mail store location. So as you can see UMRA’s ability to manage Exchange accounts is very versatile, and flexible, allowing you do most scripts you have now in VBScript, or Peal, to be converted quickly and easily. No more having hundreds of lines of code to create an Exchange Mailbox, now it’s done in 1 simple UMRA script action.

Keep an eye on my blog, we will next talk about how UMRA handles Exchange 2007 with windows Powershell!

UMRA - Lotus Notes Migration

2009-05-07T21:45:00.000-07:00

UMRA – Lotus Notes Migration

Converting from one security model to another is no easy task, epically if you have thousands of Users accounts to provision, and objects to move. However, with UMRA this task becomes quite simple. Some of the different migration scenarios that we’ve heard our clients want to do are Lotus Notes > Active Directory, E Directory > Active Directory and so forth. This Blog will focus on the power of UMRA – Lotus Notes Migration. UMRA has over 30 Lotus Notes actions ready for you to use, no VBScripts, no Pearl scripts etc. Just easy to use drag and drop actions that will let make your Migration go a lot smoother, and make sure your User Accounts and different Objects are created correctly.

UMRA – Lotus Notes Migration Tips

We will talk about this at a high level, and really focus on the “how” most Migrations are handled, and give you a good idea of how flexible UMRA really is. With UMRA we can create a table of Lotus Notes Users, or create a table of Lotus Notes Users from a CSV… We can now loop through that table, and have accounts created, and added to specific OU’s depending on data pulled from the Users account in Lotus Notes. Once, the account is created, in another script, or same script, we can now apply group memberships, create home folders, and create exchange mailbox’s if needed. As you can see, UMRA can handle the whole user creation process, as well as the Lotus Notes Migration quickly and effectively. Again, this was more a higher level look, and shows how easy a migration can be.

UMRA – Lotus Notes Actions

UMRA – Command Line Utility

2009-05-07T21:40:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA > http://www.tools4ever.com/download/

UMRA – Command Line Utility

User Management Resource Administrator is a very resourceful tool when managing Active Directory Objects. Some of you may be use to doing everyday Active Directory Tasks with old VBScripts or Pearl Scripts. You don’t need to throw out these old scripts that you have, you can now execute them with UMRA – Command Line Utility Action. Yes…you heard me right, you can now pass data from a UMRA script to the Command Line, and have it do its work…what does this mean and how will it benefit you? There are some applications that offer a API, or command line remote call to execute specific methods for their programs or ways to communicate back and forth. We’ve had a lot of different clients have us provision downstream User Accounts in other systems with UMRA that only had an API to talk to.

UMRA – Command Line Utility Tips

Most VBScripts or Peal script that you run now to manage your Active Directory can actually be converted into UMRA projects. UMRA has the ability to Create / Edit / Modify Active Directory Objects, Create Exchange Accounts 2003 2007, LDAP Controls and so much more, so most likely, your older scripts can be converted easily. Plus, you will now be able to update and change your scripts easily instead of having to deal with hundreds of lines of code for your older projects.

UMRA – Command Line Utility Example

Create A New UMRA Project, and drag / drop a “Execute command line” action to your script. This action can be found under Other Actions > Execute command line. Copy and Paste this below script to a blank .vbs file

VBScript
Wscript.Echo "Hello"
Wscript.Quit 0
VBScript

Now in your UMRA “Execute command line” action add this C:\> cscipt hello.vbs
Run your UMRA project, and bingo you have now run your first Command Line from UMRA.

UMRA – Student Information Sync

2009-05-05T18:01:00.000-07:00

UMRA – Student Information Sync

What is a Student Information System (SIS) Sync you may ask? A SIS sync is linking up your Student Information System’s Database to a UMRA Automation project and having the UMRA run a set of projects on a hourly, daily, or a chosen interval to make sure your Active Directory is in sync with your Student Information System. How is this possible you ask? UMRA has the ability to connect to any ODBC valid database, if UMRA does not have direct access, you can also get a SQL View or CSV of data, and have that replicated and put into a Database on a daily basis. Many of our clients are looking for this exact procedure; they need the student’s accounts, email, and home folders created quickly, and keep Active Directories data integrity unpolluted. So below I will go over a quick way to get such a sync setup. Below will be a more a high lever overview, since each environment is always going to be different, you should be able to take these same steps with UMRA and get your Student Information in Sync with Active Directory.

UMRA – Student Information Sync Steps

First you will need to get a “View” created in your current Student Information System, or create your own custom query to get the data needed to run the UMRA Automation project. Once your data is set, now you can setup a UMRA foreach action on your table, if you need help with this, please see my other posts on how to loop through table data. In your UMRA foreach action you will now do a search in Active Directory for the users based of criteria from your “View” of data, or direct database connection. If the users IS in Active Directory, go to your compare project. Your compare project will check information such as, firstname, lastname, description, or any other Active Directory Attribute you need to check. If the users IS NOT in Active Directory, go to a create user project, or insert this data into a database etc. This is the highest level of a Student Information System Sync, keep coming back later to see more in detail some of the tips and tricks of such a UMRA Automation project.

UMRA – Access Management

2009-05-04T17:25:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA > http://www.tools4ever.com/download/

UMRA – Access Management

In any company allowing specific users to Access Software applications, programs, etc… is a very difficult task. Most of the time you need to a large set of IT staff to help manage access to these different business applications. This is the classic scenario we run into when developing UMRA – Projects for our clients. UMRA has the ability to manage group objects in Active Directory, so now Access Management with UMRA is a breeze. UMRA, can handle Access Management 3 ways, UMRA - MASS , UMRA - Delegation, and UMRA - Automation. What is best for you? All methods will help you control your Active Directories Access Management, however do them all in a different fashion. I will break the different types of ways you can do this below, for each of the UMRA modules.

How Does UMRA handle Access Management?

UMRA - MASS

With this method we can create a custom UMRA script that will take network data, or CSV data etc. and based off a column of data, we can add or remove a group membership from a specific user. This doesn’t have to be 1 group at a time; you can have as little or as many groups applied, or removed from a user as needed.

UMRA - Delegation

With this method you can create a custom UMRA - Forms, delegate out those forms to a specific group of users, or a single user to manually add/remove users from a group with single button click. How does this method help you though? The subset of users that you allow access to this application, don’t need to have any elevated rights in Active Directory, and only users you Delegate the UMRA - Form out to. Plus, every time the user adds/removes a user from a group, it’s done with your UMRA script action, and this whole process is done with very strict Access Management controls.

UMRA - Automation

This method is very similar to the UMRA - MASS method, however you can now add your script to an automated schedule. How does adding your UMRA script to an automated schedule benefit the company? Simple… you can now have your script run every 10 minutes or hour etc. and depending on if your CSV or database data has changed, it will reflect that in your Active Directory environment.

UMRA – Logging and Auditing

2009-05-01T17:43:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA > http://www.tools4ever.com/download/

UMRA – Logging and Auditing Overview

More and more clients we build UMRA - Automation / UMRA - Mass / UMRA – Delegation projects for are looking for a way to make sure that every action UMRA is taking on a Active Directory Object is recorded into some type of “record system”. In most cases, we will log this data out to a SQL database for the user to quickly obtain the Logging and Auditing information. Why is this important you may ask, and why would you or clients want this? The answer is simple, Audits and Compliance standards are everywhere theses days, and having all the actions taken on a user in Active Directory, at your finger tips, is a solution to this problem.

Here are a few steps on how get your projects to start Logging and Auditing UMRA scripts actions that affect Active Directory Objects.

UMRA – Logging and Auditing Steps

Step 1: Find out where you will store your log data – SQL / Access / CSV etc.Step 2: Setup your database, and database columns for the data to be inserted into.Step 3: For each script action, that affects an Active Directory Object
A. Affecting an Active Directory Object can be creation / deletion / modification
B. If your logging to a CSV then drag/drop a “Export Variables” action to your script, after your Action has taken place.
C. If your logging to a Database then drag/drop a “Update Database” action to your script, after your Action has taken place.
Step 4: Edit your action, to log your specific variables that you want to record.
A. For most of our clients, username, who did the action, time/date, action type, new value, old value are what they record into the database.
Step5: Repeat steps 1-4 on each action

Once all script actions are in place, you now have a compete logging system in place for your UMRA project.

UMRA - User Provisioning

2009-04-28T21:06:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA > http://www.tools4ever.com/download/

In recent posts we’ve learned how to do some user provisioning with UMRA MASS module. We’ve also learned how to use “Map Tables” and If/Then/Elses. However, there is another key “Action” in UMRA that we have not touched on yet, and that is the “For Each” Action. What is this you ask? The “For Each” Action allows you to loop through a table of data, such as users, OU’s, groups, or different types of Active Directory Objects. Pass the Objecs data to another UMRA project script and have it execute actions on that Object. How did this help me with my identity management needs…simple it allowed me to make smaller more manageable scripts that really helped keep my Active Directory clean, and unpolluted. I am now able to run a specific UMRA project script, have it do all of my user management tasks in 1 run, rather then having to run multiple scripts or use other programs to finish these needs.

So let me show you how I was able to create a very small UMRA script that was able to help me with my user provisioning of student accounts.
If you need help with setting up data from a CSV please see my post here.
Steps for Creating the UMRA script:Step 1: Create a New UMRA script can call it “For Each Loop Test”
A. Set up your CSV in the “data tab” see this post for help.
Step 2: Drag/Drop 1 “Generate generic table” action to your script. This can be found under the tree Variable actions > Table > Generate generic Table
Step 3: Configure the “Gernerate gerneric table”
A. Click “configure”, then in the “Table Type” select “LDAP query
B. Click “LDAP binding” tab, and the click the radio button Binding string, and enter your binding, see the examples on the screen on how to format this string
C. Click “LDAP Filter” tab, and in the drop down, select the filter “All users” and then press “Insert”
D. Click “Attributes” tab, and Add the attributes, Samaccountname, and description
E. Click “Variable” tab, and give the table the variable “%user_table%”
F. You now can click “Run Test” tab, and see your users within your OU that you selected.

Step 4: Drag/Drop 1 “For-Each” Action to your script. This can be found under the tree Variable actions > Programming > For-Each
Step 5: Configure your “For-Each” action like below:
A. The Table variable name will be the table we created earlier of users
B. The Project name is the project we will send this table of data to
C. The Variable of project column is the variable we set for each loop through the table.

Step 6: Create a New UMRA script can call it “For Each Loop Test 2” This will be the script that we will execute when we lop through our table.

Step 7: Drag/Drop 1 “Get user (AD)” Actions to your new UMRA script. This action can be found under the tree User > Active Directory > Get User (AD)
A. Configure your “Get user (AD)” similar to the pics below
a. If you need help with this, please see this post here.

Step 7: Drag/Drop 1 “Export variables” Actions to your new UMRA script. This action can be found under the tree Variable actions > Variable operations > Export variables
B. Configure your “Export variables” similar to the pics below

With that, your UMRA scripts are ready to go. What does this script do you ask? It will help you with getting users in your Active Directory information, and write that data to a CSV file. Now that you have this CSV file, you can either run this data through another UMRA project you have or email or send the CSV to someone. This particular method has helped me out in nervous projects.

UMRA - Mapping Tables

2009-04-27T09:47:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA à http://www.tools4ever.com/download/

In this blog post I am going to tell you about a scenario I ran into when trying to manage my Active Directory User Accounts. I was given a task to update over 3500 User accounts in 2 days. I was given a CSV of the user’s data, and was told I need to make sure the data in the CSV matched what was in Active Directory; I also needed to make sure each account was given groups based on a special column in the CSV. This type of User Provisioning is a huge task, however, since I’ve been using UMRA for sometime now, I knew this task would now take a few hours to create the script and run it, compared to 4 or 5 days of updating each user account singly. So how did I update all these Active Directory User Accounts so fast……see the below steps on how I did it.

I was looking through some of the UMRA Actions and noticed an action called “Map Variable”. You can find this action under the tree Variable Actions à Programming à Map variable. This action allows you take a value passed in from CSV, Network data, Active Directory Object etc. and do a check on it. So you can now pass this action, some data and have it do a check to see if it matches anything in the “Map Table” if it does, assign another variable the value that it matched. How did this help me? I was now able to pass the description from my CSV of User Data, to this Script Action, and have it check to see if that description matched anything in my “Map Table” if it did, kick out a variable with the Active Directory Group’s name that I needed to add to the user.

Here is a screen shot of my “Map Variable” action:

If you need help with attaching a CSV to your project see this blog: here
If you need help with if/then/else clauses see this blog: here

As you can see, I have a variable called %csv_description% that I am passing into this “Map Variable” action, and its going to see if that matches any of my Input values, if it does, it will update the variable called %group_dn% with the matching output value.Now that we have the “Map Variable” action down, here is a quick look at the rest of my script. Let me explain a bit what’s going on here in my UMRA script.

--> First I Map my passed variable from my CSV data to the “Map Variable” action.
--> I get the Active Directory user object (see my first blog post on how to do this)
--> I remove all group memberships of the Active Directory user object
--> I add the mapped group to the Active Directory user object
--> Then we update the Active Directory User Object Attributes

If you notice we have some “error logic” added to our script now. This will be our next topic I want to go over. So until next time!

UMRA If Then Else Tips

2009-04-22T20:51:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever.

Download Trial Version of UMRA à http://www.tools4ever.com/download/

In my first blog, I talked about how I was able to run a MASS project, to quickly update/get/create an active directory object. My script was simple, and didn’t have a lot of logic built into it. However, after poking around a bit in the “scripts” section of UMRA I found a few very powerful script actions, the main one we are going to talk about is the “If-Then-Else” Action with a few “No operation” Actions. These actions will allow us to really put some logic into our scripts, and have them do more then just run top to bottom. We will now be able to check conditions, such as: If the user’s description = xxxxx do this, if it doesn’t do that….

These actions are found in tree Variable actions à ProgrammingHere is a quick break down of how an “If-Then-Else” statement works. Like most scripts, you can check a condition; it can be a numeric value, strings, date range and a few others. How can you use this…you ask? You can now run CSV, database, or network data through your script, and check values in Active Directory. For Example, if we have a CSV of userdata, and there description for a Human Resources (HR) system, we can now say something like this:

IF = User in Active Directory Description = CSV User DescriptionTHEN = Don’t Update AccountELSE = If it’s different Update Account

This is how most “If Then Else” equations work, we first check the condition, if it matches, jump to another part in the UMRA script, if it doesn’t match, let go to an “update user” section in the script. Here is a quick visual representation on how it works.

If you are wondering what the “Get User (AD)” and “Get attribute (AD)” Actions are in the UMRA script, please see my first post Basics of UMRA.

So how has this 1 simple Action helped me? With “If Then Else” equations in my scripts I am now able to add logic into my script, I can now check conditions, as if I were doing this by hand, and only run cretin parts of my script. So I hope this helps some of you out there getting your feet wet with UMRA. My next blog post will be on Using the “Map Variable” action.

Active Directory Tool - UMRA

2009-04-20T08:13:00.001-07:00

Hey everyone… I had to make a new blog about a very nifty tool I’ve been using for sometime now to help with my everyday day to day Active Directory Management. The tool I’ve been using is called User Management Resource Administrator, developed by tools4ever. This by far has been the single most important tool in my array of User Life Cycle Management Tools for Active Directory. Let me tell you, I’ve seen tons of tools out there to help you with this task, or that task, however, User Management Resource Administrator (UMRA for short) is the only I’ve found to be flexible to my needs, and my specific tasks. No more spending countless hours developing some VB Script, or looking online for some tool to help me do my tasks, I can now simply create my own script using simple drag and drop actions with UMRA and be done in minutes. Below I will show you a few basics examples how to get your feet wet with UMRA.

Download Trial Version of UMRA à http://www.tools4ever.com/download/
Once you have installed UMRA we are ready to create a simple Mass project. Mass project you ask? A Mass project is a quick way to update or get Active Directory objects in bulk. So for example, I could update all Users in Active Directory with a new description and phone number from a CSV or Network data I have. The days of going through each account 1 by 1 is over… What use to take me around 8-10 hours to update 1500+ accounts, now takes me 8-10 seconds.

So let’s begin…
1. Click File à New à Mass Project
2. Expand the Variable Actions Tree à Variable Operations à Drag/Drop 2 “Set Variable” Options to your script window.
A. Click on the first “Set Variable” action, and give it a variable name and value
a. VariableName = %dc% VariableValue = One of Your Domain Controllers
B. Click on the second “Set Variable” action, and give it a variable name and value
a. VariableName = %domain% VariableValue = Your Domain Name

When you’re done with the above steps your script window should look like below.

3. Expand the User Tree à Active Directory à Drag/Drop “Get User” optionThis option will allow us to Bind to the User Object, and update, or get information from it.
A. Click on the “Get User” option we pulled over and double click on it.
a. Right click on %FullName% and select “Clear Value”
b. Double Click on “Domain controller” and update its value to %dc%
When you’re done with these steps your script screen should look like below.

4. Expand the Active Directory Tree à Drag/Drop “Set attribute” option
This option will allow us to “Set/Update” the User Objects account with a new value.
A. Click on the “Set attribute (AD)” option in your script
a. Right click on %ActiveDirectoryObject% and select “Clear Value”
b. Double click on LDAP attribute displayname click on Value Radio Button, then in the drop down select “description”
c. Double click on Attribute value and set the variable to %csv_description%
When you’re done with these steps your script screen should look like below.

Now that our script is completed, we can now need to provide it with some type of data.
I created a 2 column CSV with the users accountname, and the new description.
If you want my example you can download it here à Download My CSVClick the “File data” tab, next to the “Script” tab.
Right Click in the white space below the tab, and select “Import File Data”
Locate your file and click “Ok”

You will now see the data from your CSV on your screen, we will now set column variables. What this will do is, each time the script runs, it will take the data in that column, and apply it to the scripts variables.
Right Click on “Column_A” and click on “properties”, set the variable to %UserName%
Right Click on “Column_B” and click on “properties”, set the variable to %csv_description%

When you’re done with these steps your script screen should look like below.

Now your project is ready to run.Right click on 1 of your accounts, and select “Run Selection”. On the “Log Messages” lower window, you will see the actions log as to what happened when you just ran your first mass project.

Now that you’ve updated the Active Directory Account, go check the account in AD to verify.

If you want to run your complete CSV file, select “Run” instead of “Run Selection”..

If you have any questions let me know, I will post other scripts later.

My New Blog

2009-04-17T08:01:00.000-07:00

Here is my new blog, very cool