Description:

This step disables an existing Active Directory user account.

The Disable Active Directory User workflow step connects to Microsoft Active Directory via a configured LDAP connection and disables the specified user account.

The step identifies the user by the specified username and changes the account status from enabled to disabled. Once disabled, the user can no longer authenticate or access Active Directory resources until the account is re-enabled.

This step provides an efficient way to automate user account deactivation as part of employee offboarding, temporary account suspension, security incident response, or identity lifecycle workflows.

The step supports:

• Active Directory user account management
• Disabling Active Directory user accounts
• Configurable LDAP connections
• Dynamic username input using workflow variables
• Integration with Microsoft Active Directory

This step can be used for:

• Employee offboarding
• Temporary account suspension
• Security incident response
• Identity lifecycle management
• HR system synchronization
• Access management
• Business process automation

Usage:

The Disable Active Directory User step is typically placed after an employee termination, a leave-of-absence approval, a security event, or an account suspension process within a workflow.

The workflow disables the specified Active Directory user using the configured LDAP connection.

A typical workflow might look like this:

Once the user account has been disabled, later workflow steps can:

• Remove group memberships
• Revoke application access
• Synchronize identity systems
• Notify administrators
• Generate audit reports
• Archive user resources
• Continue identity lifecycle management processes

You need to set up an LDAP connection before using this step.

Go to:

Integration → Connections → Generic Connections

On the Manage Generic Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

A sample connection is provided here for reference. 

Example:

Let’s build and execute the “clsDisableADUserDef” example:

• Create a new process definition named “clsDisableADUserDef” and open it in designer mode. 
• Drag a “clsDisableADUser” step to the canvas.
• Connect the dots between the “Start” and “clsDisableADUser” steps.
• Click the "clsDisableADUser" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Enter the “Username”. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Disable User step, FlowWright connects to the configured Active Directory server using the selected LDAP connection and attempts to disable the specified user account. If the operation completes successfully, the workflow follows the Disabled return path. If the user account cannot be found, is already inaccessible, or the LDAP connection cannot be established, the workflow follows the NotDisabled return path.

• Click the process step to view its properties. The step should disable the specified Active Directory user account and return Disabled upon successful completion. Use the Read Active Directory User step to verify that the account status has been updated.

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Ensure that the LDAP account has permission to modify Active Directory user objects.
• Verify that the specified user account exists before attempting to disable it.
• Use workflow variables to dynamically provide the username.
• Use the Disabled and NotDisabled return paths to implement appropriate success and error handling.
• Consider combining this step with Remove Users from Group, Update User Attributes, or Archive User Data activities as part of an employee offboarding workflow.
• Combine this step with Create User, Enable User, Read User, or Add Users to Group steps to automate complete Active Directory identity management workflows.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured LDAP account must have sufficient permissions to modify Active Directory user objects.
• The specified user account must already exist in Active Directory.
• Disabling a user account does not delete the account, remove passwords, modify group memberships, or change user attributes.
• Disabled accounts can be reactivated later using the Enable User workflow step.
• Network connectivity or authentication issues may prevent the account from being disabled.
• The workflow should include appropriate error handling for the NotDisabled return path.
• The workflow result depends on the current state of the user account and the permissions granted to the configured LDAP connection.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Username mapping
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.