Checking Active Directory Field Uniqueness During Create User
When creating users in environments with multiple Active Directory domains or forests, it is often necessary to ensure that key directory attributes are unique across all target directories. This article describes an approach for validating and generating unique values during the Create User process in Activate.
Please note the script examples provided may need tweaking to work on later versions of Activate, they are provided as-is as guides or inspiration.
Overview
In multi-domain or multi-forest environments, user creation can fail or cause conflicts if attributes such as login names or email addresses already exist elsewhere. To prevent this, Activate can be configured to validate uniqueness across multiple directories before the user is created.
This approach:
- Collects multiple OU references across domains and forests
- Uses a PreCreate script to build a directory collection
- Calls custom utility methods to validate uniqueness
- Automatically generates the next available value when conflicts are detected
Scenario
This approach is suitable when:
- Users may be created in different domains or forests
- A single naming standard is enforced across the organisation
- Attributes must be unique beyond the target OU
The validation OUs do not need to match the final user placement. They are used solely for checking existing objects.
High-level Process
- Configure OU references for each domain or forest to be checked
- Collect those OUs during the PreCreate phase
- Pass the OU collection into custom utility methods
- Validate uniqueness for common identity attributes
Configure OU References
Add a UserOU parameter to the Create User task. Configure this parameter with OU references for every domain or forest that must be checked for existing users.
Collect OUs in the PreCreate Script
In the PreCreate script, load all configured UserOU values into a collection that can be passed to utility methods.
Generate a Unique Login Name
To generate a unique samAccountName across multiple domains, a NameGenerator can be combined with a custom validation method.
This method iterates through generated values until a unique login name is found across all configured OUs.
Generate a Unique UPN and Email Address
User principal name, email address, and alias values can be generated and validated together to ensure global uniqueness.
Validate Uniqueness Across Domains
Each generated value is validated against every configured OU to ensure no conflicts exist.
The underlying checks validate the following attributes:
- samAccountName
- mailNickname
- userPrincipalName
- proxyAddresses (SMTP and SIP)
- targetAddress
Import the Utility Class
To make the utility methods available during user creation, import the class at the top of the PreCreate script.
Example NameGenerator Expressions
The following examples show NameGenerator expressions commonly used with this approach.
Login name expression:
User principal name expression:
These expressions can be adjusted to align with organisational naming standards and domain structures.