Lewis County streamlines Active Directory administration with ADManager Plus and ServiceDesk Plus

Key challenges

• User provisioning relied on a custom web application and manually executed PowerShell scripts.
• Account creation involved several steps, including setting up user accounts, assigning organizational units, generating temporary passwords, creating home folders, and configuring Microsoft 365 mailboxes and group memberships.
• Different departments and elected offices required their own account attributes, organizational unit placements, and access permissions.
• The relationship between job positions and their required group memberships was not fully documented, limiting how much of the provisioning process could be automated through predefined rules.
• The IT team wanted to integrate user provisioning with its existing ServiceDesk Plus implementation.

Business challenges

Lewis County's Information Technology Services team supports a shared Active Directory environment across multiple elected offices, departments, and divisions. Although these groups operate within a central directory, their requirements differ, making consistent user provisioning and access assignment a challenge.

Before implementing ADManager Plus, the team used a locally hosted, custom web application to collect information for user creation and offboarding requests. Submissions generated tickets in ServiceDesk Plus, while PowerShell scripts handled much of the actual account administration. The process included creating users, moving them into the appropriate organizational units, generating temporary passwords, creating home folders, setting up Microsoft 365 mailboxes, and assigning the groups required for access and licensing.

The team wanted to automate these activities through a direct integration with ServiceDesk Plus, reducing the manual work involved in creating accounts.

The solution

The team also needed a more consistent way to collect user information and apply the right account settings. With multiple departments and positions requiring different access, the county needed configurable rules that could take the information provided in a request to determine how an account should be created.

The solution: ADManager Plus

Integrating ServiceDesk Plus with Active Directory provisioning

Lewis County implemented ADManager Plus with ServiceDesk Plus to connect service requests to user provisioning. The county's existing custom web form collects the required information and generates a ticket in ServiceDesk Plus. The service desk template populates the relevant fields based on the form submission and configured conditions.

ADManager Plus retrieves ticket information from a configured ServiceDesk Plus Cloud input view. The integration uses endpoint configuration and OAuth authorization. Fields from the ServiceDesk Plus template are mapped to the corresponding LDAP attributes in Active Directory, allowing the provisioning rules to process the request information.

Once it retrieves a request, ADManager Plus applies the configured user creation rules. These rules determine the attributes and account settings to be applied, including the appropriate organizational unit and group memberships for the provisioning scenario.

The workflow also supports notifications when the configured provisioning tasks are completed. This gives the team a way to track completion without relying solely on manual follow-up.

Configuring account creation for different departments

The county's organizational structure requires account creation rules to accommodate different offices, departments, and divisions. During implementation of ADManager Plus, the team refined its templates and conditions to use the relevant organization and department information when determining the user's organizational unit placement.

The team also reviewed the organization attributes configured in ADManager Plus to ensure that department and division names matched the values available in the request fields. Consistent naming and field mapping ensures the automations that depend on those values apply the correct rules.

The configured onboarding workflow can create users and associate them with the relevant groups. This replaces the need to execute separate commands manually for each configured task, while keeping the provisioning process connected to the county's existing service desk workflow.

Addressing group membership and access requirements

Assigning group memberships presented a separate challenge. Lewis County had not yet documented all the relationships between job positions, departments, and the groups users needed to access applications and resources.

During the implementation sessions, ManageEngine Implementation Manager Nepoleon demonstrated the Copy User Attribute feature in ADManager Plus. This allows technicians to select attributes, including group memberships, from an existing user and copy them to another user. The approach provides a manual option for cases where an existing account has the appropriate access.

However, the team recognized that copying memberships would not replace the need for clearly defined, position-based access rules.

The county planned to work with department heads to identify the roles associated with positions and determine the groups required for each role. Once these relationships are documented, they can be incorporated into the user creation rules to extend automation beyond the initial configuration.

Extending automation to user modifications and offboarding

The implementation also covered how existing user creation rules could be reused when configuring user modification templates. This provides a way to apply consistent logic when a user's department or title changes and the associated group memberships need to be reviewed or updated.

Lewis County was also working on its offboarding and revocation workflow. At the time of the recorded implementation session, this configuration and the end-to-end testing were still in progress. The team was continuing to validate the complete onboarding process and refine the rules needed for its different provisioning scenarios.

The implementation experience

Nepoleon, implementation manager at ManageEngine, worked with Lewis County's IT team to configure the integration, refine the provisioning rules, and explain how ADManager Plus could support the county's requirements.

The implementation sessions covered service desk field mapping, conditional user creation, organizational unit placement, group membership handling, modification rules and workflow options. The discussions also helped the team explore alternatives for scenarios such as department transfers and accounts requiring additional access beyond the initial provisioning rules.

Although the team had documentation available for its existing tools, understanding how different product features could work together was more difficult. Working through real scenarios with Nepoleon helped the team see the bigger picture and consider alternative ways to handle its requirements.

Key benefits

The integration established a path for Lewis County to manage configured user provisioning tasks through its existing ServiceDesk Plus request process and ADManager Plus.

The organization has achieved the following:

• Connected request and provisioning workflows: ServiceDesk Plus tickets provide the information ADManager Plus uses to process configured user creation tasks.
• Standardized request information: Structured fields and conditional rules help ensure that the required details are collected consistently.
• Automated account configuration: Configured rules can apply user attributes, organizational unit placement, and group associations based on request information.
• Improved task visibility: Completion notifications help the team track provisioning work.
• A foundation for broader automation: The team can extend its rules as it documents position-based access requirements and finalizes additional user modification and offboarding workflows.

The project also gave the IT team a clearer understanding of how ADManager Plus could support its broader account administration requirements. The county can continue refining its rules as the required access relationships are documented and the remaining workflows are tested. Mannikko would recommended ADManager Plus to other agencies, highlighting its range of features and integration options.

Mannikko would recommended ADManager Plus to other agencies, highlighting its range of features and integration options.

About ADManager Plus

ADManager Plus is an identity governance and administration (IGA) solution that simplifies identity management, ensures security, and improves compliance. With ADManager Plus, manage the user life cycle from provisioning to deprovisioning, run access certification campaigns, orchestrate identity management across enterprise applications, and protect data on your enterprise platforms with regular backups. Use over 200 reports to gain valuable insights into identities and their access rights. Improve the efficiency of your IGA operations with workflows, automations, and role-based access control policies. ADManager Plus' Android and iOS applications help with on-the-go AD and Azure AD management. For more information about ADManager Plus, visit https://www.manageengine.com/products/ad-manager/.

OnboardPro

OnboardPro is a ManageEngine service that provides solution implementation to clients upon request. This service includes the installation and customized configuration of ManageEngine solutions. It enables clients to seamlessly begin work without worrying about the complexities of product installation, deployment, and use. Every client environment is unique and requires additional support beyond the basic installation and standard features. With custom onboarding, clients have the option to engage a team of product experts to manage the installation, implementation, customization, and training based on their business needs. For more information, visit manageengine.com/onboarding/manageengine-onboardpro-iam-and-siem-professional-service.html.