When using Orchestration Activity "Create AD Object", or "Update AD Object", cannot set CN, or name attribute - Support and Troubleshooting

When using Orchestration Activity "Create AD Object", or "Update AD Object", cannot set CN, or name attribute Issue When using Orchestration Activity "Create AD Object", or "Update AD Object", if passing CN or name in "Object data", error is received in the ECC that's generated by the activity.

Cause This is expected behavior.

When using activity "Create AD Object", CN field is created based on "ObjectData". As in doc below, "Object name is also used for the name attribute in Active Directory. This behavior is available in ActiveDirectory.psm1. Whatever is passed as the Object name becomes both the samAccountName and the name of the new user in Active Directory."

https://docs.servicenow.com/csh?topicname=r_CreateADObject.html&version=latest

When using "Update AD Object", in the PowerShell script used by the activity, we assign properties to the object using: $object.Properties[$property].Value=$objectData[$property] ; Then we apply the change using: $object.CommitChanges();

However this method cannot be used to update CN or Name attributes. The rename method of System.DirectoryServices.DirectoryEntry object has to be used.

Resolution You can create a custom PowerShell activity to update the "name" field for the user object.

As a good gesture, below is some customised code that you can use.

***Please note since this is customisation, the code is for demonstration only, and not supported by ServiceNow.

Firstly create a MID server script file (make sure the file name ends with .ps1, e.g. something.ps1) with content below:

### Start of the script ###

$user = $cred.Username $password = $cred.GetNetWorkCredential().Password

$rootEntry = New-Object System.DirectoryServices.DirectoryEntry "LDAP://$domainController", $user, $password;

$search = New-Object System.DirectoryServices.DirectorySearcher $rootEntry; $search.Filter = "(&(objectClass=User)(samAccountName=$sAMAccountName))"; $result = $search.FindOne();

if ($result -eq $null) { throw New-Object System.ArgumentException($search.Filter + " could not be found"); }

$object = $result.GetDirectoryEntry();

if ($object -eq $null) { throw New-Object System.ArgumentException("The object could not be retrieved from: " + $search.Filter); }

$object.Rename("CN="+$newname); $object.CommitChanges();

### end of the script ###

Then create a custom powershell activity, select this mid server script, and define below powershell variables in "Execution Command" tab: DomainController sAMAccountName newname