Active Directory Sync: User Guide

The Active Directory Sync tool is used to perform a one way Synergetic to AD synchronisation of active staff, students, and community members. Synergetic becomes the "Source of Truth" for the managed users and groups. All changes made to the managed objects will be overwritten during the next synchronisation process.

The synchronisation key between Active Directory and Synergetic is the Synergetic NetworkLogin field and Active Directory sAMAccountName

If the NetworkLogin field has not been completed, the name portion of the occupation email address is used.

If both the NetworkLogin and the email address are missing an error is generated.

Current version

The current version is 19.05.09.01

Features

• Option to globally enable or disable synchronisation
• Report is sent to administrator each synchronisation detailing
  • Newly created users (including their password)
  • Modified users
  • Modified groups
  • Errors
• Three separate sync options
  • Staff
  • Student
  • Community
• Optionally create on premise Exchange email mailbox on new account creation
• Optionally create Home Drive directory and network share on new account creation
• Optionally set password to be changed on first logon for new accounts
• Up to six separate Organisation Units per sync that can be managed
• Run a "What If" test where only the report is produced, but no actual changes are made
• Run a sync only on nominated users

Setup

Configuration Maintenance

All global active directory synchronisation settings are set in Systems | Configuration Maintenance in the keys System | ADSync

* Community options require additional on site configuration

+ Exchange actions require appropriate roles on Exchange server

The synchronisation process sends a completion email and uses email settings from Synergetic.

Lookup tables

There are six sets of lookup tables for each of of the staff and students sync options and one for community that determine how members will be synchronised

• Category (uluADCommunityCategory, uluADStaffCategory and uluADStudentCategory)
• Group (uluADStaffGroup and uluADStudentGroup)
• Default UPN Override (uluADCommunityUPN, uluADStaffUPN, uluADStudentUPN)
• Default Exchange Mailbox Override (uluADStaffExchange, uluADStudentExchange)
• Default AD Home Directory Override (uluADStaffDirectory, uluADStudentDirectory)
• Default ad Logon script override (uluADStaffLogonScript, uluADStudentLogonScript

For Community, there is only the category option (uluCommunityCategory)

Category

The category lookup tables determine the Organisational Unit location in Active Directory of new accounts. New accounts can be based on one (and only one) field option;

For staff the field options are:

• Category
• Department
• Staff campus
• Form
• House

For students the field options are:

• Boarder
• Campus
• Form
• House
• Peer Year
• Tutor
• Year level

For community, there is only one option

• (Not selected) - The default option

There must be a default (blank value) option where users not matching any rules will fall into. This may be a generic Organisational Unit in Active Directory.

Group

The group lookup tables map fields to groups. Multiple mappings are permitted (with field and value combination being unique).

Group membership of groups nominated in the Group Distinguished name will be purged prior to synchronisation.

A global group option is available for an all staff or all student group

This will synchronise all active members to the nominated group

Default UPN Override

The UPN override tables allow for individual category override of the default UPN. If the table remains blank the default UPN from the System Configuration is used.

All UPN values must start with the '@' symbol.

Default Exchange Database Override

The default exchange database override allows for individual category override of the Exchange database specified in the System Configuration. If the table remains blank, the default value from the System Configuration is used.

Default AD Home Directory Override

The default AD home directory override allows for individual category override of the Active Directory Home directory created on new account creation as specified in System Configuration. If the table remains blank, the default value from the System Configuration is used.

Default AD Logon Script Override

The default AD logon script override allows for individual category override of the Active Directory logon script set on new account creation as specified in System Configuration. If the table remains blank, the default value from the System Configuration is used.

Synchronisation executables

Prerequisites

• Windows PowerShell v5
  • Windows Powershell extensions for SQL Server
  • Windows Powershell extensions for Active Directory
  • Exchange Powershell snap-in (For exchange mailbox creation only)
• Run as administrator
• Email server set up to allow logged on user to send email or accept anonymous email from the current machine

There is an executable for each type of synchronisation

• StaffSync.exe
• StudentSync.exe
• CommunitySync.exe

They each have the same input parameters

Example 1

Connects to the primary instance of the SQL server using SQL authentication without making any changes to Active Directory.

StaffSync.exe -SQLServer 'DBServer' -Database 'SynergyOne' -UseWindowsAuthentication:$false -SQLUser 'sa' -SQLPassword 'password' -WhatIf

Example 2

Connects to the instance named "Instance" on the database server using Windows authentication.

StaffSync.exe -SQLServer 'DBServer\Instance' -Database 'Synergetic_AUVIC_CDA_PRD' -UseWindowsAuthentication:$true

Syncronisation

The Synergetic fields are synchronised (via views) to the Active Directory attributes as listed below. These views are user customisable. Alternate fields can be mapped within the views as long as the field name remain consistent

Staff sync

View: uvStaffSync

Student Sync

View: uvStudentSync

Community Sync

View: uvCommunitySync

* Community Sync can use ID number to avoid clashes