One of the most common external systems we have in MIM is Active Directory. Managing users in Active Directory involves understanding how Active Directory works. A functional MIM design has to adhere to the restrictions of the systems it interfaces with, and Active Directory is no exception.
There are some attributes in Active Directory that require special treatment and knowledge, such as the userAccountControl attribute.
Note
Note that in our implementation, the idea is that management of normal users in Active Directory is to be made using MIM, but the initial password is set by the users themselves when they visit the security officer's desk to identify themselves and sign a form about account usage. At the desk, there is a small web application where the user can fill in his initial password.