Authentication Manager 8.x
Active Directory users
Internal Database users

In the case of acquisitions and mergers, sometimes companies want to unify the username format.  If one company uses firstname.lastname, and the other uses an abbreviated lastname with first initial, it makes sense to unify these into one standard format.  This means we have to change some of the usernames to match the format of the others.

Internal Database:  Assuming we have an Enterprise license, we can run an AMBA script to change the username format.

Active Directory:  If we have an external identity source, AM only has a read-only connection.  We need a PowerShell script to convert the username format.

Recommendations:

• As always, MAKE A BACKUP before attempting. 
• Prudence dictates running a script on one or two users to validate results, before attempting to run in bulk.

Internal Database

1.  Create an AMBA script with the following columns (Excel is very useful for this:)

Action,DefLogin,MiscVariable

2. Populate the file with the corresponding information:

Action,DefLogin,MiscVariable
UUD,planey.mcplaneface,mcplap

3. Save you file (in this example we will call it amba-UUD.csv).
4. Copy this file to your Authentication Manager Primary using WinSCP or similar.  You can put it in /opt/rsa/am/utils, or /home/rsaadmin.  Just make a note of the path and filename.
5. Invoke AMBA using the following command.  For security reasons, you should always put your credentials in an .ini file.  See https://community.rsa.com/s/article/RSA-Authentication-Manager-Bulk-Admin-AMBA-Crash-Course for more details on how to do this.  An example.ini file is attached to this article.

cd /opt/rsa/am/utils
./rsautil AMBulkAdmin --ini example.ini

      6.  Before and after of one user after running the script:

Before:

After:

Active Directory

For AD users, we will need to build a similar CSV file, and run the attached PowerShell script from the Domain Controller.

1. First, create an input file called ADusers.csv.  There should be three columns:SamAccountName,NewSamAccountName,NewUPN
2. Add your data following the header format:SamAccountName,NewSamAccountName,NewUPN
   mcboab,boaty.mcboatface,boaty.mcboatface@securidcs.net
3. Copy this file and the attached PowerShell script to the same directory on your Domain Controller.
4. Run the script:rename_AD_users.ps1
5. Before and after screenshots from the Security Console:

Before:

After:

As always, MAKE A BACKUP before attempting the steps above. 

Prudence dictates running a script on one or two users to validate results, before attempting to run in bulk.