Disable & Move User

This is an interactive task for disabling a User in Active Directory & optionally moving them to a different Organizational Unit.

Playbook Files

This playbook was built for PPA version 3.3

plugins:
  active_directory: ^13.0
  hashicorp_vault: ^8.0
  ppa: ^11.4


set:
  search_base: null


steps:


  - name: Greeting
    actions:

      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.active_directory.full }}


            #### Active Directory - Disable & Move User


            Use this task to disable a User in Active Directory, & optionally move them to a different Organizational Unit.


            You will need to:


            - Search for & select the User

            - Confirm the user should be disabled

            - Choose whether to move the User

            - Select an Organizational Unit if applicable


      - ppa.ui.input_accept:
          text: Start


  - name: Get Secrets
    actions:

      - hashicorp_vault.key_value.read_secret_keys:
          secret: active_directory
          keys:
            - name: address
            - name: domain
            - name: username
            - name: password
              sensitive: true
          reason: Getting Active Directory details
          create_missing: true
        save: domain_controller


  - name: Get User
    actions:

      - active_directory.users.get_interactive:
        load:
          domain_controller: domain_controller
        save: active_directory_user


  - name: Skip Disable If Already Disabled
    when: active_directory_user.is_disabled
    actions:

      - ppa.ui.output_info:
          text: The user is already disabled, this step will be skipped.

      - set:
          name: confirm_disable
          value: false

      - ppa.ui.input_accept:
          text: OK


  - name: Disable User
    when: active_directory_user.is_enabled
    actions:

      - ppa.ui.input_confirm:
          text: Disable {{ active_directory_user.cn }}?
        save: confirm_disable

      - active_directory.users.disable:
        load:
          distinguishedName: active_directory_user.distinguishedName
          domain_controller: domain_controller
        when: confirm_disable

      - ppa.ui.output_error:
          text: The user will not be disabled.
        when: not confirm_disable


  - name: Get User Parent OU or CN
    actions:

      - safe_eval:
          expression: >
            ",".join(active_directory_user["distinguishedName"].split(",")[1:])
        save: current_directory_location


  - name: Ask Move User
    actions:

      - ppa.ui.output_markdown:
          doc: >
            **Current Directory Location:** {{ current_directory_location }}

      - ppa.ui.input_confirm:
          text: Move the user?
        save: move


  - name: Exit If Disabled But Not Moved
    when: confirm_disable and not move
    actions:

      - ppa.ui.output_markdown:
          doc: >
            ### Updated User Details

            User **{{ active_directory_user.cn }}** was disabled but not moved.

      - exit:
          exit_code: 0


  - name: Exit Early If No Operations
    when: active_directory_user.is_disabled and not move
    actions:

      - ppa.ui.output_info:
          text: The user will not be modified, goodbye!

      - exit:
          exit_code: 0


  - name: Get Organizational Units
    when: move
    actions:

      - ppa.ui.output_progress:
          text: Getting all Organizational Units...
          element_id: getting_ous

      - active_directory.organizational_units.get_all:
        load:
          domain_controller: domain_controller
        save: organizational_units

      - ppa.ui.output_progress:
          text: Got all Organizational Units
          percent: 100
          element_id: getting_ous


  - name: Select New Organizational Unit
    when: move
    while:
      name: change_confirmed
      value: false
      restart: name_clash
    actions:

      - set:
          name: name_clash
          value: false

      - active_directory.organizational_units.select_one:
          text: Select new Organizational Unit
        load:
          organizational_units: organizational_units
        save: organizational_unit

      - ppa.ui.output_error:
          text: The user is already in the selected location, please select a different one.
        when: current_directory_location == organizational_unit.distinguishedName

      - ppa.ui.input_accept:
          text: OK
        when: current_directory_location == organizational_unit.distinguishedName

      - set:
          name: name_clash
          value: true
        when: current_directory_location == organizational_unit.distinguishedName

      # Check for existing users contained immediately in the OU.
      - active_directory.users.search:
          search_params:
            cn: "{{ active_directory_user.cn }}"
          one_level: true
        load:
          search_base: organizational_unit.distinguishedName
          domain_controller: domain_controller
        save: search_result

      - ppa.ui.output_error:
          text: A user with the same name already exists in the selected Organizational Unit, please select again.
        when: search_result.total > 0

      - set:
          name: name_clash
          value: true
        when: search_result.total > 0

      # Check for existing groups contained immediately in the OU.
      - active_directory.groups.search:
          search_params:
            cn: "{{ active_directory_user.cn }}"
          one_level: true
        load:
          search_base: organizational_unit.distinguishedName
          domain_controller: domain_controller
        save: search_result

      - ppa.ui.output_error:
          text: A group with the same name already exists in the selected Organizational Unit, please select again.
        when: search_result.total > 0

      - set:
          name: name_clash
          value: true
        when: search_result.total > 0

      - ppa.ui.output_markdown:
          doc: >
            ## Change Summary


            Please review the following change.


            ### Selected User


            **Name:** {{ active_directory_user.cn }}


            **Current Directory Location:** {{ current_directory_location }}


            ### New Organizational Unit


            **Name:** {{ organizational_unit.name }}


            **Directory Location:** {{ organizational_unit.distinguishedName }}

      - ppa.ui.input_confirm:
          text: Is this correct?
        save: change_confirmed


  - name: Move User
    when: move
    actions:

      - ppa.ui.output_progress:
          text: Moving the User to new Organizational Unit...
          percent: null
          element_id: moving_user

      - active_directory.users.move:
        load:
          domain_controller: domain_controller
          distinguishedName: active_directory_user.distinguishedName
          parent_distinguishedName: organizational_unit.distinguishedName

      - ppa.ui.output_progress:
          text: User has been moved to the new Organizational Unit
          percent: 100
          element_id: moving_user


  - name: Get Updated User
    when: move
    actions:

      - ppa.ui.output_progress:
          text: Getting updated User record...
          percent: null
          element_id: get_updated_user

      - active_directory.users.by_samaccountname:
        load:
          domain_controller: domain_controller
          sAMAccountName: active_directory_user.sAMAccountName
        save: updated_user

      - ppa.ui.output_progress:
          text: Got updated User record
          percent: 100
          element_id: get_updated_user

      - ppa.ui.output_markdown:
          doc: >
            ## Updated User Details


            **Name:** {{ updated_user.cn }}


            **Updated Directory Location:** {{ updated_user.distinguishedName }}

Running this Playbook

Click download playbook
Import the playbook on the Playbooks page in PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

Integrations

PPA User Interface
Hashicorp Vault Key-Value engine
Active Directory Users, Groups, & Organizational Units

Required Vault Details

Active Directory

IP/DNS address of a Domain Controller
Domain FQDN
Username
Password

As this is a privileged task, the Active Directory credentials require the permission to disable & move Users.

Vault Configuration Wizard

The first time you run a task built from this playbook, PPA will check the required Vault details exist.

If they don't exist, PPA will ask you to supply the details at the start of the task.

Below you can see a user providing details the first time they run an Active Directory task.

vault-config-wizard

Once the details are added to Vault, the task won't ask for them again.

If you don't know the required details, ask an administrator to run the task or configure Vault manually.

What the Task Does

Once started, this task allows the operator to:

Search for and select an Active Directory User
Confirm the User should be disabled
Optionally choose an Organizational Unit to move the User to

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.