Articles in this section

See more

UserAccountControl with Exclusion Group Report

Avatar
Peter Sidebotham (SIDM)
  • Created
  • Updated
Follow

This report allows filtering of users based on flags in their userAccountControl field. It allows a group to be created to isolate users who should be excluded from the report results.

This report requires the AD Users Base report.

Version 3.4 and Higher

{
  "Data": [
    {
      "$type": "SoftwareIDM.ReportingModule.Models.Report, SoftwareIDM.ReportingModule",
      "Id": "a87f3fc8-bf10-44d1-bd9e-762454043af0",
      "Name": "UserAccountControl Flags with Exclusion Group",
      "UserId": null,
      "UserProfile": false,
      "Tags": null,
      "Roles": null,
      "CacheExpiration": "12:00:00",
      "Description": "This report demonstrates a modification of the userAccountControl flag report that excludes individual roles based on memership in an exclusion group. ",
      "Parameters": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.SelectReportParameter, SoftwareIDM.ReportingModule",
          "ValueChoices": [
            "PASSWD_NOTREQD",
            "PASSWD_CANT_CHANGE",
            "ACCOUNTDISABLE",
            "NORMAL_ACCOUNT",
            "INTERDOMAIN_TRUST_ACCOUNT",
            "DONT_EXPIRE_PASSWORD",
            "SMARTCARD_REQUIRED",
            "TRUSTED_FOR_DELEGATION",
            "PASSWORD_EXPIRED"
          ],
          "Name": "Flag",
          "Description": "",
          "Required": true,
          "Validation": "",
          "DefaultValue": ""
        }
      ],
      "DataSets": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
          "Clauses": [
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Silo",
              "Operation": "Eq",
              "Value": "special.Identity Silo.MIM: AD"
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "ObjectType",
              "Operation": "Eq",
              "Value": "\"group\""
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "DN",
              "Operation": "Contains",
              "Value": "\"CN=UAC Exclusion Group\""
            }
          ],
          "SubQueries": [],
          "MapRule": "",
          "MemoRules": [
            {
              "$type": "SoftwareIDM.ReportingModule.Models.MemoRule, SoftwareIDM.ReportingModule",
              "Name": "Exclude",
              "Rule": "Id"
            }
          ],
          "Aliases": null,
          "Name": "Exclusion Group",
          "Type": "SoftwareIDM.PanelModel.Models.ObjectRecord, SoftwareIDM.PanelModel"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
          "Clauses": [
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Silo",
              "Operation": "Eq",
              "Value": "special.Identity Silo.MIM: AD"
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Attribute",
              "Operation": "Eq",
              "Value": "\"member\""
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Deleted",
              "Operation": "NotExists",
              "Value": ""
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "ObjectId",
              "Operation": "In",
              "Value": "Memo(\"Exclude\")"
            }
          ],
          "SubQueries": [],
          "MapRule": "",
          "MemoRules": [],
          "Aliases": null,
          "Name": "Members",
          "Type": "SoftwareIDM.PanelModel.Models.MultiAttr, SoftwareIDM.PanelModel"
        }
      ],
      "ReportSets": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.ReportData, SoftwareIDM.ReportingModule",
          "Name": "Users",
          "Report": "cb5036bf-5ee6-43b0-b6ee-9fba04c3ea3b",
          "Aliases": null,
          "MemoRules": []
        }
      ],
      "Relations": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
          "Name": "User to Member",
          "LeftSet": "Users",
          "RightSet": "Members",
          "LeftRule": "Data.Id",
          "RightRule": "Value",
          "AllowLeftOuter": false,
          "AllowRightOuter": true
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
          "Name": "Member to Group",
          "LeftSet": "Members",
          "RightSet": "Exclusion Group",
          "LeftRule": "ObjectId",
          "RightRule": "Id",
          "AllowLeftOuter": false,
          "AllowRightOuter": false
        }
      ],
      "FieldProjections": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "DN",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "$\"{TimeTraveler(Id)}|{DN}\""
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "EmployeeID",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "employeeID"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "EmployeeType",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "employeeType"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "DisplayName",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "displayName"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "AccountName",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "sAMAccountName"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "UserAccountControl",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "userAccountControl"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "Exclude",
          "RelationName": "Member to Group",
          "RelationSide": "Right",
          "ValueRule": "DN"
        }
      ],
      "Transformations": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
          "FilterRule": "And(Contains(UserAccountControl, Memo(\"Flag\")), Not(Exclude))",
          "GroupingRule": "",
          "TransformRules": [
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "DN",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "EmployeeID",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "EmployeeType",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "DisplayName",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "AccountName",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "UserAccountControl",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            }
          ]
        }
      ],
      "Styles": [],
      "Sort": {
        "Field": "EmployeeID",
        "Direction": "Ascending"
      }
    }
  ],
  "Count": 1
}

Version 3.2 to 3.3

{
  "Data": [
    {
      "$type": "SoftwareIDM.ReportingModule.Models.Report, SoftwareIDM.ReportingModule",
      "Id": "a87f3fc8-bf10-44d1-bd9e-762454043af0",
      "Name": "UserAccountControl Flags with Exclusion Group",
      "UserId": null,
      "UserProfile": false,
      "Tags": null,
      "Roles": null,
      "CacheExpiration": "12:00:00",
      "Description": "This report demonstrates a modification of the userAccountControl flag report that excludes individual roles based on memership in an exclusion group. ",
      "Parameters": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.SelectReportParameter, SoftwareIDM.ReportingModule",
          "ValueChoices": [
            "PASSWD_NOTREQD",
            "PASSWD_CANT_CHANGE",
            "ACCOUNTDISABLE",
            "NORMAL_ACCOUNT",
            "INTERDOMAIN_TRUST_ACCOUNT",
            "DONT_EXPIRE_PASSWORD",
            "SMARTCARD_REQUIRED",
            "TRUSTED_FOR_DELEGATION",
            "PASSWORD_EXPIRED"
          ],
          "Name": "Flag",
          "Description": "",
          "Required": true,
          "Validation": "",
          "DefaultValue": ""
        }
      ],
      "DataSets": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
          "Aliases": null,
          "MapRule": "",
          "Name": "Exclusion Group",
          "Type": "SoftwareIDM.PanelModel.Models.ObjectRecord, SoftwareIDM.PanelModel",
          "Clauses": [
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Silo",
              "Operation": "Eq",
              "Value": "special.Identity Silo.MIM: AD"
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "ObjectType",
              "Operation": "Eq",
              "Value": "\"group\""
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "DN",
              "Operation": "Contains",
              "Value": "\"CN=UAC Exclusion Group\""
            }
          ],
          "SubQueries": []
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.QueryData, SoftwareIDM.ReportingModule",
          "Aliases": null,
          "MapRule": "",
          "Name": "Members",
          "Type": "SoftwareIDM.PanelModel.Models.MultiAttr, SoftwareIDM.PanelModel",
          "Clauses": [
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Silo",
              "Operation": "Eq",
              "Value": "special.Identity Silo.MIM: AD"
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Attribute",
              "Operation": "Eq",
              "Value": "\"member\""
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "Deleted",
              "Operation": "NotExists",
              "Value": ""
            },
            {
              "$type": "SoftwareIDM.PanelModel.Models.FilterClause, SoftwareIDM.PanelModel",
              "Field": "ObjectId",
              "Operation": "In",
              "Value": "Map(Memo(\"Exclusion Group\"), Id)"
            }
          ],
          "SubQueries": []
        }
      ],
      "ReportSets": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.ReportData, SoftwareIDM.ReportingModule",
          "Name": "Users",
          "Report": "cb5036bf-5ee6-43b0-b6ee-9fba04c3ea3b"
        }
      ],
      "Relations": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
          "Name": "User to Member",
          "LeftSet": "Users",
          "RightSet": "Members",
          "LeftRule": "Data.Id",
          "RightRule": "Value",
          "AllowLeftOuter": false,
          "AllowRightOuter": true
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Relation, SoftwareIDM.ReportingModule",
          "Name": "Member to Group",
          "LeftSet": "Members",
          "RightSet": "Exclusion Group",
          "LeftRule": "ObjectId",
          "RightRule": "Id",
          "AllowLeftOuter": false,
          "AllowRightOuter": false
        }
      ],
      "FieldProjections": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "DN",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "$\"{TimeTraveler(Id)}|{DN}\""
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "EmployeeID",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "employeeID"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "EmployeeType",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "employeeType"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "DisplayName",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "displayName"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "AccountName",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "sAMAccountName"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "UserAccountControl",
          "RelationName": "User to Member",
          "RelationSide": "Left",
          "ValueRule": "userAccountControl"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "Exclude",
          "RelationName": "Member to Group",
          "RelationSide": "Right",
          "ValueRule": "DN"
        }
      ],
      "Transformations": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
          "FilterRule": "And(Contains(UserAccountControl, Memo(\"Flag\")), Not(Exclude))",
          "GroupingRule": "",
          "TransformRules": [
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "DN",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "EmployeeID",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "EmployeeType",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "DisplayName",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "AccountName",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            },
            {
              "$type": "SoftwareIDM.ReportingModule.Models.TransformField, SoftwareIDM.ReportingModule",
              "Field": "UserAccountControl",
              "Name": "",
              "Operator": "None",
              "TransformRule": ""
            }
          ]
        }
      ],
      "Styles": [],
      "Sort": {
        "Field": "EmployeeID",
        "Direction": "Ascending"
      }
    }
  ],
  "Count": 1
}

Related articles

Comments

0 comments

Please sign in to leave a comment.