Forum Discussion
Write custom field on user creation on AD
Thanks. I understand and that would be great. But in our organization, where we got about 20 people creating and managing users, it will be really difficult to implement such a huge change on the user creation and management process. Most of the team is still very dependent of the GUI tools.
Do you see any other way?
Thanks
If the people doing the creating are members of the "admin" groups (i.e. Enterprise Admins, Domain Admins or Administrators) then the following won't help you. But if you've gone down the best practice route of removing everyone and leveraging Active Directory delegation, read on.
When a "non-admin" creates an object in Active Directory, the "owner" within the ACL (click the Advanced button in the Security tab to see the listed owner if you're not sure how/where to check this) is set to the creator's account. Ergo, you can report on the "owner" and the process is tool-agnostic (see caveat below about middleware.)
If everyone's just been dumped in one of the "admin" groups, this won't work as when such people create objects, the "owner" value is set to "Domain Admins" instead of the person doing the creating.
The caveat is middleware that performs the administration activities under its own process identity. That won't help with native reporting as outlined above but it's possible such products have their own internal reporting mechanisms you can leverage.
Cheers,
Lain