Description:

This step unlocks an existing Active Directory user account.

The Unlock Active Directory User workflow step connects to Microsoft Active Directory via a configured LDAP connection and unlocks a user account that has been locked due to failed sign-in attempts or account lockout policies.

The step identifies the user by their username and performs the unlock operation without modifying the user's password or group memberships.

The step supports:

• Active Directory account unlock
• Configurable LDAP connections
• Username-based user lookup
• Automated account recovery
• Integration with Microsoft Active Directory

This step can be used for:

• Help desk account recovery
• Employee support
• Service desk automation
• Identity lifecycle management
• User administration
• Account lockout remediation
• Business process automation

Usage:

The Unlock Active Directory User step is typically placed after a user verification or help desk approval process within a workflow.

The workflow unlocks the specified Active Directory user account using the configured LDAP connection.

Once the account has been unlocked, later workflow steps can:

• Notify the user by email
• Update the service desk ticket
• Record the unlock event
• Generate audit reports
• Resume onboarding or business processes
• Continue identity management workflows

Before using this step, configure an LDAP Connection.

Go to:

Integration → Connections → LDAP Connections

On the Manage LDAP Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

Example:

Let’s build and execute the “clsUnlockADUserDef” example:

• Create a new process definition named “clsUnlockADUserDef” and open it in designer mode. 
• Drag a “clsUnlockADUser” step to the canvas.
• Connect the dots between the “Start” and “clsUnlockADUser” steps.
• Click the "clsUnlockADUser" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Enter the “Username”. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Unlock User step, FlowWright connects to the configured Active Directory server using the selected LDAP connection and attempts to unlock the specified user account. If the account is successfully unlocked, the workflow follows the Unlocked return path. If the account cannot be unlocked—for example, because the user cannot be found, the account is already unlocked, or the LDAP connection cannot be established—the workflow follows the NotUnlocked return path.

• Click the process step to view its properties. The step should unlock the Active Directory user account and return the value “Unlocked,” as shown in the example below.  

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Use workflow variables to dynamically populate the username.
• Verify that the specified user account exists in Active Directory.
• Use this step together with service desk or self-service password reset workflows.
• Record account unlock activities for auditing and compliance purposes.
• Use the Unlocked and NotUnlocked return paths to implement appropriate success and error handling.
• Combine this step with notification or password reset steps to provide a complete account recovery workflow.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured LDAP account must have sufficient permissions to unlock Active Directory user accounts.
• The specified username must already exist in Active Directory.
• Unlocking an account does not reset the user's password or modify any group memberships.
• Network connectivity or authentication issues may prevent successful account recovery.
• The workflow should include appropriate error handling for the NotUnlocked return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Username mapping
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.