---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Use the userAccountControl field

# Find inactive LDAP accounts by using the userAccountControl field {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Identify when an Active Directory (AD) user is deleted (or made inactive).

## Vorbereitungen

Role required: admin

## Warum und wann dieser Vorgang ausgeführt wird

One method is to track the active status of AD users and create a business rule to update corresponding accounts when an AD account is inactive.

## Prozedur

1. Create a new string field on the User \[sys_user\] table to track the value of the AD userAccountControl field.  
   For example: `u_ad_user_account`.
2. Create an LDAP transform script to set the field value.  

       target.u_ad_user_account = source.userAccountControl

3. Update the LDAP filter to show disabled AD accounts.  
   Here is an example of a filter.  

       (&(objectClass=person)(sn=*)(!(objectClass=computer))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

   Here is an example of a replacement filter you can use.  

       (&(objectClass=person)(sn=*)(!(objectClass=computer)))

4. Create an onChange business rule to set the active field to false whenever the u_ad_user_account field has the value 514.  
   '514' indicates an inactive account.