Move User

This is an interactive task for moving an Active Directory user to a different Organizational Unit.

Playbook Files

This playbook was built for PPA version 3.3

# The task was built to work with these plugin versions.
plugins:
  ppa: ^11.4
  hashicorp_vault: ^8.0
  active_directory: ^13.0


steps:


  - name: Greeting
    actions:

      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.active_directory.full }}


            #### Active Directory - Move User


            Use this task to move an Active Directory user from to a different Organizational Unit.


            You will need to:


            - Search for & select the Active Directory user

            - Choose a new Organizational Unit


      - ppa.ui.input_accept:
          text: Start


  - name: Get Secrets
    actions:

      - hashicorp_vault.key_value.read_secret_keys:
          secret: active_directory
          keys:
            - name: address
            - name: domain
            - name: username
            - name: password
              sensitive: true
          reason: Getting Active Directory details
          create_missing: true
        save: domain_controller


  - name: Get User
    actions:

      - active_directory.users.get_interactive:
        load:
          domain_controller: domain_controller
        save: active_directory_user

      - safe_eval:
          expression: >
            ",".join(active_directory_user["distinguishedName"].split(",")[1:])
        save: current_directory_location

      - ppa.ui.output_markdown:
          doc: >
            **Current Directory Location:** {{ current_directory_location }}

      - ppa.ui.input_confirm:
          text: Move the user?
        save: move


  - name: Exit If Not Move
    when: not move
    actions:

      - ppa.ui.output_info:
          text: The user will not be moved.

      - exit:
          exit_code: 0


  - name: Get Organizational Units
    actions:

      - ppa.ui.output_progress:
          text: Getting Organizational Units...
          percent: null
          element_id: get_organizational_units

      - active_directory.organizational_units.get_all:
        load:
          domain_controller: domain_controller
        save: organizational_units

      - ppa.ui.output_progress:
          text: Got {{ organizational_units | length }} Organizational Units
          percent: 100
          element_id: get_organizational_units


  - name: Select Organizational Unit
    while:
      name: change_confirmed
      value: false
      restart: name_clash
    actions:

      - set:
          name: name_clash
          value: false

      - active_directory.organizational_units.select_one:
          text: Select Organizational Unit
        load:
          organizational_units: organizational_units
        save: organizational_unit

      # Check for existing users contained immediately in the OU.
      - active_directory.users.search:
          search_params:
            cn: "{{ active_directory_user.cn }}"
          one_level: true
        load:
          search_base: organizational_unit.distinguishedName
          domain_controller: domain_controller
        save: search_result

      - ppa.ui.output_error:
          text: A user with the same name already exists in the selected Organizational Unit, please select again.
        when: search_result.total > 0

      - set:
          name: name_clash
          value: true
        when: search_result.total > 0

      # Check for existing groups contained immediately in the OU.
      - active_directory.groups.search:
          search_params:
            cn: "{{ active_directory_user.cn }}"
          one_level: true
        load:
          search_base: organizational_unit.distinguishedName
          domain_controller: domain_controller
        save: search_result

      - ppa.ui.output_error:
          text: A group with the same name already exists in the selected Organizational Unit, please select again.
        when: search_result.total > 0

      - set:
          name: name_clash
          value: true
        when: search_result.total > 0

      - ppa.ui.output_markdown:
          doc: >
            ## Change Summary


            Please review the following change.


            ### Selected User


            **Name:** {{ active_directory_user.cn }}


            **Current Directory Location:** {{ current_directory_location }}


            ### New Organizational Unit


            **Name:** {{ organizational_unit.name }}


            **Directory Location:** {{ organizational_unit.distinguishedName }}

      - ppa.ui.input_confirm:
          text: Is this correct?
        save: change_confirmed


  - name: Move User
    actions:

      - ppa.ui.output_progress:
          text: Moving the User to new Organizational Unit...
          percent: null
          element_id: moving_user

      - active_directory.users.move:
        load:
          domain_controller: domain_controller
          distinguishedName: active_directory_user.distinguishedName
          parent_distinguishedName: organizational_unit.distinguishedName

      - ppa.ui.output_progress:
          text: User has been moved to the new Organizational Unit
          percent: 100
          element_id: moving_user


  - name: Get Updated User
    actions:

      - ppa.ui.output_progress:
          text: Getting updated User record...
          percent: null
          element_id: get_updated_user

      - active_directory.users.by_samaccountname:
        load:
          domain_controller: domain_controller
          sAMAccountName: active_directory_user.sAMAccountName
        save: updated_user

      - ppa.ui.output_progress:
          text: Got updated User record
          percent: 100
          element_id: get_updated_user

      - ppa.ui.output_markdown:
          doc: >
            ## Updated User Details


            **Name:** {{ updated_user.cn }}


            **Updated Directory Location:** {{ updated_user.distinguishedName }}

Running this Playbook

Click download playbook
Import the playbook on the Playbooks page in PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

Integrations

PPA User Interface
Hashicorp Vault Key-Value engine
Active Directory Users & Organizational Units

Required Vault Details

Active Directory

IP/DNS address of a Domain Controller
Domain FQDN
Username
Password

The Active Directory credentials need permission to unlock a user.

Vault Configuration Wizard

The first time you run a task built from this playbook, PPA will check the required Vault details exist.

If they don't exist, PPA will ask you to supply the details at the start of the task.

Below you can see a user providing details the first time they run an Active Directory task.

vault-config-wizard

Once the details are added to Vault, the task won't ask for them again.

If you don't know the required details, ask an administrator to run the task or configure Vault manually.

What the Task Does

Once started, this task allows the operator to:

Search for & select an Active Directory user
Choose a new Organizational Unit to move them to

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.