Return
-
Title
New User Creation and Group Membership Changes -
Description
When creating a new user and also modifying the memberOf attribute the following error is generated:
The server is unwilling to process the request. Administration Service encountered an error when creating the object 'cn=User123 Test,OU=Lab,DC=domain1,DC=corp'. Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM). (Exception from HRESULT: 0x8007209A) -
Cause
When adding a user to a group, they have to first exist in Active Directory. On the New User form, the user does not exist and is not created until after the Finish button is pressed.
-
Resolution
There is no supported way of setting MemberOf during account creation at all, this action must happen after the account is physically created in the domain.
Workaround:
- Create a virtual attribute of type boolean for each group if there are only a few, then have a workflow execute based on the custom attribute being set to True. Alternatively, if all users will be put into static groups, have the workflow simply do this on every New User Creation and do not implement virtual attributes. See Screenshot: Workflow
-
Attachments
