Linking "Normal" accounts to "Admin" Accounts

I would start by establishing a new virtual attribute on your users - perhaps call it edsvaLinkedAdminAccount

First decision is whether to make it single or multi-valued. This depends on how you name your admin accounts and whether the names change if a user has accounts in multiple domains.

Let's take the simple case where you use the same name regardless of domain. Let's assume your samaccountname naming convention is something like this: smithj_admin.  Populate the virtual attribute of each user with their "linked" admin account name.
 
Then, setup an ActiveRoles workflow that detects an account deprovision. It should check to see if the edsvaLinkedAdminAccount is populated and the proceed to search for the account named in the VA in all ActiveRoles managed domains. Then, deprovision each account returned by the search.

For this, you should be able to use a built-in Search activity followed by a Deprovision activity.

To support this, I would create a Search Activity named something like "Found Admin Accounts".

The results of the Search activity are passed to your Deprovision activity.

Principle is the same for the Manager change - instead of deprovisioning, you just apply the new Manager name in a workflow triggered by a Manager update.

Here, just because I am used to doing it this way, I would use a script fired by the results of the Search Activity to update the Manager.

The only "trick" here is how to get the list of found users to your script activity.

The list of users found by the search would be presented in $workflow.FoundObject("Found Admin Accounts") so:

$MyFoundAdminAccounts = $workflow.FoundObject("Found Admin Accounts")

The new Manager name would be retrieved from the update transaciton using some PoSh like this:

$NewManager = $Request.Get("ManagedBy")

You then just iterate through $MyFoundAdminAccounts and stamp each one with the new Manager name.

Hi,

Thanks for your answer. For what ever reason I do not see the admin accoung being decomissioned. Can you perhaps be a bit more specific what needs to be configured to get this working?

Thanks.