Mark terminated LDAP users as inactive in ServiceNow

We Find inactive LDAP accounts using the last refresh time. In this method, we add a Last Refreshed field to the user record and set the value during the import process. We create a scheduled job that checks for users that have not been refreshed in 30 days, and deactivate them.

 Create a datetime field on the User [sys_user] table. example, u_last_refreshed.

Add the following code in the transform script

target.u_last_refreshed = gs.now();

Create a scheduled job to find and deactivate the user accounts that have not been refreshed in 30 days.

disable_users();

function disable_users() {

    /*

     * query for active users with ldap source and last updated more than 30 days ago

     * disable them

     */

    var gr = new GlideRecord("sys_user");

    gr.addQuery('u_last_refreshed', '<', gs.daysAgoStart(30));

    gr.addQuery('active', true);

    gr.addQuery('source', '!=', '');

    gr.query();

    while (gr.next()) {

        gr.active = false;

        gs.log("Disabled inactive user: " + gr.user_name + " - last updated: " + gr.u_last_refreshed);

        gr.update();

    }

    gs.log("Completed disabling inactive accounts");

}

 More details about this implementation can be found here