AD Users | Create AD LDS account rule

Limit the scope to this domain or OU

This setting defines the search query scope.

To improve query performance, limit the scope to a specific OU.

Query criteria

Query criteria are sent with the query and may improve query performance.

AD LDS anchor attribute 

Defines the attribute in the AD LDS to which the Active Directory anchor attribute is to be compared. When a new AD LDS account is created this value also specifies the Active Directory attribute into which the AD LDS anchor is written for comparison the next time the rule is executed.

AD anchor attribute 

Defines the attribute in Active Directory that will be used to determine if the AD LDS account already exists. This value is compared to the AD LDS Anchor Attribute.

Other Query Settings

Properties to display

To display additional properties for each object found by the query, add those properties to the list.

System properties

List of properties required to this rule to be executed correctly.

Filter

To hide unwanted data set the filtering conditions here.

Example: filter by the found object Distinguished Name.

Sort by

Sort result object list.

Initialization script

Usually, rules use query criteria to limit the query search scope. It improves the performance of the executed rule.

Due to PowerShell limitations, it is not possible to use calculated expressions in query criteria. That is the point where initialization script can help. You can initialize a global variable in this setting and then use it in query criteria.

Example: Get AD LDS accounts, created in the last ten days.

1. Add this initialization script:

{$global:DatePeriod = (Get-Date).AddDays(-10)}

2. Use $DatePeriod variable in query criteria builder:

Connection Settings

AD LDS server connection credentials

AD LDS server name

AD LDS server port

The default settings are specified in AD LDS extension settings.

Create in

Specify an application partition container where AD LDS accounts will be created.

The default value is defined in Web Portal Settings section in AD LDS extension.

Attribute mapping

Populate AD LDS user properties from the selected AD master user account.

The default mapping is defined in User Accounts section in AD LDS extension.

Establish a link with AD account

When set to Yes, the created AD LDS account is linked to the AD account using objectSID attribute. If AD account has a Linked Mailbox type, the link is established to the mailbox master AD account from the account forest.

Object class for user accounts

Specify object class that is derived from organizationalPerson class.

The default value is defined in User Accounts section in AD LDS extension.

Settings for User Object Class

Default password

This setting defines the password for the new AD LDS account. This value can be a static text, can be taken from linked AD account or set to Generate Random Password.

Password never expires

Account enabled

These settings enable/disable the standard user object settings. 

Other Properties

Other properties

Use this setting for a custom modification of AD LDS account attribute values.

Add to AD LDS groups

Add to AD LDS groups

To add AD Lds accounts to groups, specify Distinguished Names of AD LSD groups split by ";".