Skip to main content

Microsoft Active Directory

Directory integration

Use NIM to manage Active Directory users, groups, computers, memberships, and organizational units from a single automation platform.

Solutions This Integration Solves​

Directory account lifecycle

Create and maintain Active Directory users, computers, and organizational units.

  • Automates lifecycle changes
  • Keeps directory records current

Group and membership management

Manage Active Directory groups and memberships through NIM workflows.

  • Supports role-based access
  • Reduces manual group work

Home folder provisioning

Create and maintain user home folders alongside directory changes.

  • Supports consistent onboarding
  • Simplifies administration

Delegated directory automation

Apply repeatable, permission-aware Active Directory operations at scale.

  • Uses controlled service access
  • Improves audit readiness

Supported operations​

TableReadCreateUpdateDelete
Acls
Computers
Contacts
Group
Membership
OrganizationalUnits
User

Guides​

Configure a managed service accountCreate and grant permissions to the account NIM uses to manage Active Directory.Configure connectionAssign the managed service account to the NIM Windows service.Manage home foldersProvision and migrate Active Directory home folders with NIM.Manage Active Directory Group PolicyUse the specialized Group Policy connector from the NIM connector library.Use the Active Directory MD connectorReview the specialized Active Directory MD connector in the NIM connector library.

Troubleshooting​

Start with the symptom that best matches what you see in NIM. Each path identifies the likely cause and the next action to take.

Problem

Access denied when NIM modifies an object

Likely cause

NIM is running as Local Service or Local System, its domain account lacks delegated rights, or an explicit deny exists in the object's access control list.

Resolution

  1. Confirm that the NIM service runs as a domain account, preferably a managed service account.
  2. Confirm that account has delegated rights to manage the affected users, groups, computers, or organizational units.
  3. In Active Directory Users and Computers, enable View > Advanced Features, then open the affected object's Properties > Security > Advanced > Effective Access.
  4. Select the NIM service account and choose View Effective Access. A red X on the requested action indicates a missing permission or explicit deny; review the object and its parent containers.

Problem

NIM cannot change password-related flags

Likely cause

The service account is not included in the Enable computer and user accounts to be trusted for delegation user-right assignment.

Resolution

  1. Open Group Policy Management and edit the Group Policy Object that manages this setting.
  2. Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
  3. Open Enable computer and user accounts to be trusted for delegation and add the NIM service account, or one of its groups.
  4. Apply the policy and try the operation again. If that setting does not exist, investigate the object's delegated permissions instead.