{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41650,"path":"platform-security/ldap-integration/t_FindInactLDAPAcctsWUsrAcctCtrlFld.md","title":"Find inactive LDAP accounts by using the userAccountControl field","bundle":null,"doc_type":null,"release":"australia","body":"\n# Find inactive LDAP accounts by using the userAccountControl field\n\nIdentify when an Active Directory \\(AD\\) user is deleted \\(or made inactive\\).\n\n## Before you begin\n\nRole required: admin\n\n## About this task\n\nOne method is to track the active status of AD users and create a business rule to update corresponding accounts when an AD account is inactive.\n\n## Procedure\n\n1.  Create a new string field on the User \\[sys\\_user\\] table to track the value of the AD **userAccountControl** field.\n\n    For example: `u_ad_user_account`.\n\n2.  Create an LDAP transform script to set the field value.\n\n    ```\n    target.u_ad_user_account = source.userAccountControl\n    ```\n\n3.  Update the LDAP filter to show disabled AD accounts.\n\n    Here is an example of a filter.\n\n    ```\n    (&(objectClass=person)(sn=*)(!(objectClass=computer))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))\n    ```\n\n    Here is an example of a replacement filter you can use.\n\n    ```\n    (&(objectClass=person)(sn=*)(!(objectClass=computer)))\n    ```\n\n4.  Create an onChange business rule to set the active field to false whenever the u\\_ad\\_user\\_account field has the value 514.\n\n    '514' indicates an inactive account.\n\n\n"}}