Managing the Active Directory Primary Group Field in Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

Reviewing if Identity Manager can manage or update the Primary Group field (primaryGroupID) on Active Directory endpoint accounts.

Environment

Identity Manager 14.x, 15.x

Resolution

Identity Manager does not support managing the Active Directory Primary Group field out of the box.

If you view the Primary Group attribute in Provisioning Manager, you will notice it is set to read-only and cannot be modified directly through standard account template attributes or UI tasks.

Workaround

To update this field, you can implement custom Java code executed via a Policy Xpress (PX) policy:

• Write a custom Java class (wrapper) that calls PowerShell commands to modify the Active Directory Primary Group attribute.

• Configure a Policy Xpress policy action to invoke your custom Java execution.

For step-by-step guidance on setting up custom Java execution within Policy Xpress, refer to Broadcom KB 36219: Explaining PX Policies (Invoking Of External Code).