# AD sAMAccountName Generator Rule **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud, rules, provisioning\ **Created:** [August 30, 2024, 2:01pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862 "2024-08-30T14:01:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![sahincelik](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@sahincelik](https://developer.sailpoint.com/discuss/u/sahincelik)\ **Post date:** [August 30, 2024, 2:01pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/1 "2024-08-30T14:01:54Z")
Hello everyone, We have a specific requirement for creating new AD accounts in IDN. Currently, we utilize an AD Username Generator Rule in the sAMAccountName field within the Create Policy of the Active Directory source, which has been functioning effectively. However, there’s a new requirement: we need to generate a unique sAMAccountName only once. This means that even if someone leaves and their AD account is deleted in the future, that sAMAccountName should not be reused for new joiners. Therefore, the AD Username rule must generate a unique value that is used only once. I’m seeking the best approach to implement this requirement in IDN. We considered creating an identity attribute called “lastADUsername” and populating it using the “Identity.setAttribute()” function, but it appears this isn’t permitted in IDN. What alternative solutions could we explore? Any suggestions would be greatly appreciated. Thanks in advance! ---
**Author:** ![ts\_fpatterson](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ts_fpatterson/32/26704_2.png) [@ts\_fpatterson](https://developer.sailpoint.com/discuss/u/ts_fpatterson)\ **Post date:** [August 30, 2024, 3:53pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/2 "2024-08-30T15:53:06Z")
For identities to remain long term, the authoritative source needs to retain the identities long term. If the authoritative source will always retain the identities, you could write back to the source the sAMAccountName, so that if they come back it will be used. If the authoritative system is not going to maintain the identities long term, a database could be used to retain Identities. ---
**Author:** ![gourab](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gourab/32/18650_2.png) [@gourab](https://developer.sailpoint.com/discuss/u/gourab)\ **Post date:** [August 30, 2024, 4:41pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/3 "2024-08-30T16:41:20Z")
> [@sahincelik](#): > > for new joiners Hi @ts_fpatterson , In such scenarios, it is generally observed that a database is maintained to store all historical mail and sAMAccountName of the identities. This enables us to refer back and generate unique emails using beforeCreate or afterCreate rules, or to link the sAMAccountName/email in the case of rehires. ---
**Author:** ![amahlemohlokonya](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/amahlemohlokonya/32/15504_2.png) [@amahlemohlokonya](https://developer.sailpoint.com/discuss/u/amahlemohlokonya)\ **Post date:** [August 30, 2024, 5:06pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/4 "2024-08-30T17:06:58Z")
Hi @sahincelik , You can create an alternative source to maintain a backup of the account, storing crucial details such as email and sAMAccountName [Plus more]. You have the option to construct a Delimited File [Manually Create] or create a JDBC source [Provision/Automate Account], and Using the ‘Rule’ as a wrapper this should resolve your issue. [Using ISCRuleUtil as a Wrapper for Common Rule Operations | SailPoint Developer Community](https://developer.sailpoint.com/docs/extensibility/rules/rule-utility) [Account Profile Attribute Generator | SailPoint Developer Community](https://developer.sailpoint.com/docs/extensibility/rules/cloud-rules/account-profile-attribute-generator/#input) ---
**Author:** ![sahincelik](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@sahincelik](https://developer.sailpoint.com/discuss/u/sahincelik)\ **Post date:** [September 2, 2024, 12:24pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/5 "2024-09-02T12:24:34Z")
Thanks all for the recommendations. @amahlemohlokonya If I understand you correctly, we can use the ISCRule Util when creating new AD accounts, allowing us to search the DB source to check whether the sAMAccountName is already in use. Is that correct? ---
**Author:** ![amahlemohlokonya](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/amahlemohlokonya/32/15504_2.png) [@amahlemohlokonya](https://developer.sailpoint.com/discuss/u/amahlemohlokonya)\ **Post date:** [September 2, 2024, 1:15pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/6 "2024-09-02T13:15:51Z")
Hi @sahincelik , Yes that’s correct ---
**Author:** ![sahincelik](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@sahincelik](https://developer.sailpoint.com/discuss/u/sahincelik)\ **Post date:** [September 2, 2024, 1:31pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/7 "2024-09-02T13:31:56Z")
Awesome! Thanks for confirmation! ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [November 1, 2024, 1:32pm UTC](https://developer.sailpoint.com/discuss/t/ad-samaccountname-generator-rule/78862/8 "2024-11-01T13:32:15Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.