Return
-
Title
How to: Schedule temporal membership -
Description
Is there a way to restrict Directory Access on demand or via a schedule?. -
Resolution
WORKAROUND 1:
Use an "Automation Workflow" that can be run manually or on a schedule basis. A workflow will need to be configured to have a parameter called userDN. This will be the user that will be removed and added back at a later time.A new PowerShell script module needs to be created to temporarily disable any specified users for a certain amount of time. The following sample will temporarily disable user "Admincm" member from group "EMEA_Contractors" for 24 hours:## BEGIN SCRIPT ##function temporaryGroupMemberRemoval($Request){# Workflow has parameter called userDN that browses for user object.$userDN = $workflow.Parameter("userDN")$groupDN = "CN=EMEA_Contractors,OU=Groups,OU=Cork,OU=Offices,DC=onisupport,DC=info" # Static DN of group.# Remove the user from the group right away.Remove-QADGroupMember -Identity $groupDN -Member $userDN# Create hash table to be used for scheduled operation control on add member.# The time is calculated for 24 hours from the current time.$time = (Get-Date).AddHours(24).ToUniversalTime()$hash = @{}$hash.add("ScheduledOperation-SetTime",$time)# Add the user back to the group using the scheduled operation control.Add-QADGroupMember -Identity $groupDN -Member $userDN -Control $hash}## END SCRIPT ##
WORKAROUND 2:Use the "Temporary Membership Settings..." feature within a Group to schedule addition/removal of specific members.
