User's 'Active' field is not being updated after LDAP import - Support and Troubleshooting

User's 'Active' field is not being updated after LDAP import Issue Once an LDAP import occurs, a User's 'Active' field does not reflect the account's status in Active Directory.

Cause This issue is most likely tied to the LDAP transform map's mapping entry for the 'Active' field. ServiceNow's 'Active' field is a checkbox that can either be set to True or False. However, LDAP has user account status through an attribute called 'userAccountControl'. This attribute has a numeric value (512 for active, and 514 for inactive). A direct mapping of the 'userAccountControl' attribute will not map to the 'Active' state.

To isolate this transform entry, take the following steps as an Admin user:

Login to your instance Navigate to your 'LDAP Servers' module Select your LDAP server Scroll to the bottom of the page and select the OU your user is in and open it Select the Data Source from the related list at the bottom of the OU page Select the Transform Map tied to the OU from the related list at the bottom of the page. Scroll to the bottom of the page and look for a mapping that maps to the 'active' field. Resolution The following steps can be taken to map the userAccountControl to the active field successfully:

Create a new string field on the User [sys_user] table to track the value of the AD userAccountControl field. For example: u_ad_user_account . Create an LDAP transform script to set the field value. target.u_ad_user_account = source.userAccountControl Update the LDAP filter to show disabled AD accounts. Here is an example of a filter. (&(objectClass=person)(sn=*)(!(objectClass=computer))((userAccountControl:1.2.840.113556.1.4.803:=2))) Here is an example of a replacement filter you can use.

(&(objectClass=person)(sn=*)(!(objectClass=computer))) Create an onChange business rule to set the active field to false whenever the u_ad_user_account field has the value 514. '514' indicates an inactive account.

The above information is retrieved from our documentation link:

https://docs.servicenow.com/csh?topicname=t_FindInactLDAPAcctsWUsrAcctCtrlFld.html&version=latest