You can enforce users to update the default password after their first login from Security Settings.

1. Hover over the Local Authentication Password fields and click Edit.
   

Users will be notified about their password via their login emails. You can configure email notifications for users from ESM > General Settings > Notification Rules > Send Self-Service Login details.

Import Users from Active Directory

Field Name	Description
Domain Name*	Select the domain to import users from. If you have already provided the domain controller and login credentials for the domain in Windows Domain Scan, the Domain Controller and Login details will be auto-populated on selecting the domain.
Domain Controller*	Specify the domain controller that provides access to resources in that domain.
Login Name*	Enter the login name of your user account in the selected domain.
Password*	Enter the password of the above user account.
LDAP SSL	Toggle LDAP SSL option ON to enable secure communication between the SupportCenter Plus and Active Directory via port 636. Ensure your Active Directory supports SSL before enabling this field.
Select fields for import	Select the default user fields to be imported from the Active Directory. Specify the field name configured in the Active Directory beside the selected field to map them accurately. If the user already exists in SupportCenter Plus MSP, their default field values will be overwritten with the values present in AD. To avoid overwriting of values, unselect the relevant fields during import. If a field value is null in AD, the corresponding field will not be updated in SupportCenter Plus MSP.
Select UDF for import	If you have configured user additional fields in SupportCenter Plus, you can select the UDF fields. Specify the field name configured in the Active Directory beside the selected field to map them. If you have not configured any user additional fields, use the Click here to configure link. You will be redirected to the User - Additional Field page where you can configure the additional fields to be imported from Active Directory. The numeric additional fields hold up to 19 digits. If your numeric value exceeds 19 digits, then configure the value in text field.
Move associated assets	If the site associated with the user/department is changed in the Active Directory, the assets belonging to the user/department should also be moved to the new site. To update this information on every import, select Move associated assets.
Update empty values	Enable this option to import and update <empty> data from Active Directory. For example, with this option enabled, user data with the First Name : Admin changed to First Name: <empty> in Active Directory will be updated in the application. If this option is disabled, then the First Name: <empty> data will not be updated and old values will be retained.

* Indicates mandatory fields

Schedule AD import

You can schedule Active Directory import at regular intervals to keep your user repository in sync with the Active Directory. When you schedule an AD import, data from all domains in the application is imported once every specified number of days. Users and user details from all the domains in the application are synced to SupportCenter Plus in two ways:

• Full Sync - Syncs all user data.
• Delta Sync - Syncs the data of updated user details and newly added user accounts once every 30 minutes.
  
• 

  Delta sync will be auto-initiated when full sync is enabled. Ensure that you perform a full sync once every 30 days to keep your user details completely updated.

User details from domains will be imported periodically as per the number of days specified after the start date and time. The differences in the data will be updated every 30 minutes. You can view the last import time and the next schedule time in the Import Schedule section.

During delta sync, only the user details that failed during import will be notified to the SDOrgAdmins via bell notification.

The criterion for User Account overwrite in Active Directory User Imports:

Criteria 1: ObjectGUID - If the ObjectGUID of a user account in SupportCenter Plus matches with the user account in Active Directory, the record in SupportCenter Plus will be overwritten.

Criteria 2: Login name and Domain - If the login name and domain of a user account in SupportCenter Plus matches with the user account in Active Directory, the record in SupportCenter Plus will be overwritten.

Criteria 3: Email address - If the 'Override based on EmailId' option is enabled under ESM Directory > Application Settings and if the email address of the user account in SupportCenter Plus matches with the Active Directory user account, the record in SupportCenter Plus will be overwritten.

Criteria 4: Login name and domain is '-' (not associated) - If a user account in SupportCenter Plus contains only a login name with an email address without a domain association and if the login name matches with the Active Directory user account, the record in SupportCenter Plus will be overwritten.

When a user is imported from AD, the ObjectGUID of the user is used as a unique identifier to update the user details in SupportCenter Plus. If the 'ObjectGUID' does not match for any user in SupportCenter Plus,

Sync deleted users from Active Directory



After the sync is completed, a list of deleted users is displayed. Based on the type of user, you can remove the deleted users from the list as mentioned below:

• Requesters - You can enable automatic deletion for non-technicians from the deleted users list. When a requester is deleted from the active directory, the user will be removed from SupportCenter Plus as well.
• Technicians - You can review the deleted technicians from the deleted users list and remove them manually. Automatic deletion is not available for technicians.
  

To configure syncing of deleted users,

1. Hover over the Sync Deleted User(s) from Active Directory checkbox and click Edit.
2. Choose your deletion method - automatic or manual. Note that even if you select automatic deletion, deleted technicians will not be removed automatically.
3. You can schedule syncing of deleted users periodically by enabling Schedule delete sync once in every option.
4. Specify the sync periodicity.
5. Enter the date and time to begin the syncing of deleted users
6. Click Save.
   

After the syncing of deleted users is scheduled, you can view the last imported time and the upcoming schedule time in the Sync Deleted Users section.

If manual delete is enabled, the link to the deleted users list will be displayed as a note on the top of the Active Directory configuration page. Use the links in the note to access and verify the deleted users before removing the deleted users from SupportCenter Plus.

 Allow Single-Sign On (SSO) using AD Credentials:

SSO allows users to instantly access SupportCenter Plus without providing any login credentials. During login, users are automatically authenticated via an Identity Provider(IdP). You can enable SSO for AD users from SAML by configuring ADFS as the IdP. To learn more, click here.

Prerequisites for configuring LDAP SSL

Follow the prerequisites mentioned below to configure LDAP SSL for your AD server:

• Ensure the server FQDN (Fully Qualified Domain Name) is accessible from client. Else, add the host entry in the host file in the client machine.
• The Active Directory Certificate Services must be installed to use LDAP SSL certificate as explained in this documentation.
• Enable your AD server to support LDAP over SSL. Click here to learn how.
• The LDAPS certificate imported to AD server in the previous step must be fetched and imported it to the client machine (SupportCenter Plus server) in the Personal folder as explained below:
• • Click Start, type mmc, and then click OK.
  • Click File and then click Add/Remove Snap-in.
  • Click Certificates and then click Add.
  • In Certificates snap-in select Computer account and then click Next.
  • On the Certificate Store page, right-click Personal > Import certificate, import the LDAP certificate from the copied folder, and provide the password set while creating the certificate.
    
• Import Root CA certificate in Trusted Root Certificate Authority to allow your client machine to trust the imported LDAP certificate. This is vital since imported LDAP certificates will not be trusted due to cross domains, by default.
  
• 
  
  • Access the CA web console: https://<CA Server>/certsrv and provide Administrator credentials. If the URL is not accessible, install Certificate Enrollment Web Service as explained in this guide.
  • In the console, click Download a CA certificate, certificate chain, or CRL.
  • On next page click Download CA certificate and save the certificate.
  • Import the downloaded CA certificate to the Trusted Root Certificate Authority as explained in the below steps,
    
  • 
    
    • Click Start, type mmc, and then click OK.
    • Click File and then click Add/Remove Snap-in.
    • Click Certificates and then click Add.
    • In Certificates snap-in select Computer account and then click Next.
    • On the Certificate Store page, right-click Trusted Root Certificate Authority and import the above certificate.