Dear all, My client have fast pace of OU changes (create & delete) in AD, so in the future we want that HR Admin can provision user from CSV file to AD (CSV file<=>FIM Portal<=>Active directory), including their container OU that never exist before in AD. How can I do that? If it possible, then what happen if I delete/change OU value in the CSV file? Will the user account be moved to the new provisioned OU or even deleted along with the deleted OU? I hope you guys understand my question (i'm not good with english) :) Thanks Best regards, Jati

Hi, FIM Synchronization Service has the ability to automatically build the OU based on the user Distinguished Name built. You only have to configure the "Configure Provisioning Hierarchy" as follow: The meaning of this step is every time you make a user provision/rename (change user DN) the OU will be automatically created on the next Active Directory export from FIM Synchronization. In this way you don't need any file for OUs. Remark: using "Configure Provisioning Hierarchy" doesn't cover deleting empty OUs. Patrick.Patrick Layani

Hi, FIM Synchronization Service has the ability to automatically build the OU based on the user Distinguished Name built. You only have to configure the "Configure Provisioning Hierarchy" as follow: The meaning of this step is every time you make a user provision/rename (change user DN) the OU will be automatically created on the next Active Directory export from FIM Synchronization. In this way you don't need any file for OUs. Remark: using "Configure Provisioning Hierarchy" doesn't cover deleting empty OUs. Patrick.Patrick Layani

Hi Patrick, thanks for the reply :) So, by using this "configure provisioning hierarchy", if the user dn like this: CN=Jeff Smith,OU=Sales,DC=Fabrikam,DC=COM and then changed to this: CN=Jeff Smith,OU=Engineer,DC=Fabrikam,DC=COM FIM will provision the OU "Engineer" along with "Jeff Smith" account inside it, is it correct? And the old account in OU Sales will be gone, leaving the empty OU Sales? Thanks, Best regards. Jati P.

Hi Jati, This is correct, except that the OU is not provisioned along with the user but created in AD when making Export to AD from FIM Sync. There is another way to provision the OU along with user but I prefer this way since it is simpler (and do not invlove any development). empty OUs won't be deleted after the user is renaming and the OU is left empty. Patrick.Patrick Layani