Automations

An automation finds the user accounts that meet your conditions and does something to them, on a schedule, on its own. For example:

• disable accounts that haven't signed in for 90 days and move them to a holding OU;
• add everyone in the Sales department to the Sales group;
• clear the manager of accounts that have been disabled for more than 30 days.

To manage them, go to Automation > Automations.

Before you start

• To get a summary email after each run, set up the email server first.
• Automations make their changes as AD Pro Toolkit's service account, so that account needs permission for each action you use, for example to disable accounts or to move them between OUs.

Create an automation

1. Go to Automation > Automations and select New automation.
2. Fill in the five sections below.
3. Select Save.

1. Basics

• Name: for example Disable stale accounts.
• Description: optional.
• Mode:
  • Active: makes the changes on every run.
  • Report only: emails what it would do and changes nothing.
  • Disabled: turned off; it doesn't run.

Start with Report only. Let it run a few times, check that the accounts it lists are the ones you expect, then switch it to Active.

2. Frequency

Choose How often and the Time:

• Daily: every day.
• Weekly: on the day you choose.
• Monthly: on a day of the month from 1 to 28.
• Once (a specific day): one run on the day you pick.

Times use a 24-hour clock, in 5-minute steps, in the time zone of the computer AD Pro Toolkit is installed on.

3. Conditions

Conditions decide which users the automation acts on.

1. Select + Add condition and pick one from the list. Use Search conditions… to find one quickly.
2. Choose the operator and the value on the row, for example Last logon, is older than, 90 days.
3. Add more conditions if you need them, and choose whether users must meet all or any of them.

The conditions are grouped:

As you build the conditions, the panel on the right shows how many users match now, with a few examples. Select View all to see the full list. Nothing is changed while you build.

An automation with no conditions matches nobody, so it can never act on the whole directory by mistake.

4. Actions

Select + Add action and choose what to do to each matching user:

Actions run in the order you list them. You can add several, for example Disable the account followed by Move to OU.

Delete the account can't be undone. When you save an active automation that deletes accounts, you're asked to confirm. A deleted account can only be brought back from the AD Recycle Bin, if it's turned on in your domain.

5. Notifications

• Email summary to: the addresses to send a summary to after each run, separated by commas. The email lists the accounts in an attached CSV file, with the change for each one and, in Active mode, whether it worked.
• Only email when there are matches: skip the email when the run found nobody.

Manage automations

The Automations page lists every automation, with its mode, when it runs and its Last run. From the icons on each row you can:

• Run now: run it straight away, without waiting for its next time.
• Edit it.
• Delete it. This doesn't undo anything it has already done.

To change the mode, use the dropdown in the Mode column. Switching to Active asks you to confirm, because from then on it makes changes.

Last run shows when it last ran and what happened, for example 12 account(s) changed. If a run failed, it shows Held / failed; hover over it to see why.

Check what an automation did

Select Logs on the Automations page. Each run is listed, newest first, with:

• how many users it Matched;
• how many it Acted on, and how many Failed;
• the Result.

Select the arrow at the start of a row to see the accounts, the change made to each one, and whether it worked. In Report only mode, it shows the accounts that would have been changed.

Every change an active automation makes is also recorded in the audit log under Settings > Logs, named after the action, for example Automation: Disable the account.

Things to know

• Conditions are checked against the latest synced data, which is synced every 30 minutes. A change made in Active Directory a few minutes before a run may not be seen yet.
• Every run acts on every matching user again. If you disable and move inactive users, add Account status is Enabled as a condition, so accounts already handled stop matching.
• Dates move with time. Last logon is older than 90 days means 90 days before each run.
• Automations work on users. Groups and computers aren't supported yet.
• One account failing doesn't stop the run. The others are still changed, and the failure is shown in the logs with the reason.
• With more than one domain, an automation runs on the domain chosen in the title bar when you created it.
• The logs keep the last 100 runs of each automation, and up to 500 accounts for each run.

Troubleshooting

• Last run shows Held / failed: hover over it to see the reason.
• Some accounts show Failed in the logs: the reason is next to each account. It's usually a permission AD Pro Toolkit's service account doesn't have in that OU.
• No email arrives: check that there are addresses under Email summary to, select Send test under Settings > Email server, and check the recipients' spam folders. If Only email when there are matches is ticked, no email is sent when nothing matched.
• "Skipped: the trial has expired": automations stop running when the trial ends. Activate a license to start them again.