GCDS + GSPS vs Azure AD

[Michael]

Hi all,

 

I've had the opportunity to setup GCDS (Google Cloud Directory Sync) + GSPS (G Suite Password Sync) and thought I'd compare it to Azure AD Connect (AAD) which I've used for years.

 

Typically I'd add G Suite as an Enterprise app in Azure and make everything 'talk' this way, but getting AD to sync with G Suite is looking at things from a different perspective.

 

GCDS is definitely more complicated, with a requirement to understand LDAP and base-dn's which make my head hurt after a while. Why Google haven't provided a tick box GUI for this excercise (just as AAD has), it'd make things easier for large structures. Thankfully hopping onto

, there are some good tutorials on there, but some of the menus have changed. Goes to show how much development Google have put into it!

 

Once all configured, unlike AAD I had to create a script along with a Scheduled Task to allow it to run every 30 mins.

 

Script
"C:\Program Files\Google Cloud Directory Sync\sync-cmd"

Arguments
-a -c "C:\GCDS Settings\GCDS-Settings.xml"

 

Again unlike AAD, GCDS doesn't handle passwords as this is done with GSPS. Thankfully I didn't have to do too much with this, other than authorise the tenancy and was straight forward, however...

 

If you create a user in AD and they sign into Windows the first time before the account is visible in G Suite (think about the GCDS script every 30 mins), they'll be forced to change their password a second time before they can use their G Suite account.

 

I also found all existing users in AD need to change their password (it could be kept the same if done by an admin), as this generates a token, which GSPS then reads. GSPS synchronisations were generally pretty quick.

 

I then continued to dive in deeper and start experimenting with disabling users in AD, but I very quickly started getting errors. I then found on the various menus there's an Exclusions tab which was set to 5%. This controls the maximum number of possible changes per cycle. Not ideal if you're only experimenting with a handful of users, so I increased it to the maximum of 80%.

 

I also found the only reliable way to disable users, was to disable them in AD and then move them to a seperate root OU in AD, rather than say a sub-OU where your staff objects are for example. Not a major issue and I'm sure it's possible, but I couldn't figure it out.

 

Increasing the number of changes per cycle from 5% to 80% doesn't concern me, as GCDS has a Simulate Sync option which was really useful. This also provides logs, so you can fix issues before they happen, unlike AAD where you find out afterwards if there's an issue.

 

So I hope this helps someone else out - I know not the most thorough of reviews, but having done both I now know the pros and cons of each!

 

AAD

Pros - probably easier to use/setup than GCDS

Pros - user and password sync in single solution

Pros - more GUI options to assist with setup

Cons - definitely heavier on memory resources

Cons - no simulation sync, fix issues on live system

 

GCDS

Pros - light on memory resources

Pros - useful log information and liked the simulation sync

Cons - definitely harder to setup, but good tutorials online

Cons - won't schedule itself to run every 30 mins

Cons - GSPS syncs passwords separately. Not sure if this is a good or bad thing?

[mavhc]

Google's also works with any LDAP server of course.

 

You could script a sync to occur right after your script to create a new user.

[Michael]

You're right I could, but that's on the presumption that everyone's using scripts to create users in AD. Some do and some don't.