Office365 - DirSync - OnPrem 2012R2 - Hybrid - .OnMicrosoft.com username issue

[cygnes]

Firstly i would like to say thank you for reading my post, i'm still fairly new to this kind of setup to please try and follow the best you can, and i will answer the best i can.

 

Our current setup as follows:

 

Secondary School.

Windows 2012 R2 FRDC : DirSync Installed syncing to Office 365 using original tenant Admin account.

Exchange Server 2010 - All users apart from afew have been migrated over to Office365, and has been working fine for a while now.

 

Ok so one of the issue's is that i have read in a few places that DirSync should not be installed on the FRDC (Why is this? and can i move it?)

A more pressing issue is that suddenly within the last week, Users that are synchronized to Office 365 are having their usernames Changed from our Schools Domain name "School.County.sch.uk" back to the default "Tenantname.onmicrosoft.com", however thier primary email address remains as the "school.county.sch.uk", I have added the UPN on our FRDC which made no difference, and I have manually selected all the users in "Users and computers" and made sure they are using "school.county.sch.uk" however they are still not changing in Office 365, am i missing a vital step here?

 

if you need more information please let me know i will provide ASAP.

 

Kind Regards

 

Paul

[snagrat]

What's a FRDC?

[sparkeh]

First thing I would say is that you need to move to Azure AD Connect as dirsync has been deprecated for some time.

 

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started

Edited February 20, 2017 by sparkeh

[Norphy]

I've sometimes found that you need to use the ProxyAddresses field inside their account to set the email address using the external domain as the primary. Might be worth a shot?

[rich_tech]

http://www.expta.com/2013/08/fixing-sign-on-name-for-renamed-users.html give that a try

[Tefters]

What's a FRDC?

 

I second this... I've worked with Office 365 from day 1 and have no clue what an FRDC is, not even google helped...

 

You should have something like the following:-

 

ADFS Server

ADFS Proxy Server (aka WAP Server)

 

That's it.

 

Yeah there is the usual Microsoft best practise failover 2x everything but depending on your hypervisor cluster setup and DR that's a load of poop.

 

My ADFS server also hosts my Azure Directory Sync.

 

The ADFS proxy server should be off the domain in a DMZ for security.

 

I also second the above post regarding proxy address field in AD, I had to manipulate this first time I setup going back 3/4 years ago on a few setups but that was a one off task and easily done via CSV import.

Edited February 20, 2017 by Tefters

[Davit2005]

Check in Proxy Servers for the users attributes and make sure the email you want to use is in there and the SMTP is in capital letters.

[mrnoisy]

What's a FRDC?

 

Forrest Root Domain Controller

 

You Google fu is not strong [emoji1306]

[Tefters]

Forrest Root Domain Controller

 

You Google fu is not strong [emoji1306]

 

It's always the simple things that elude you...

 

Yes installing DirSync on a DC use to be a big No No (at one point you physically couldn't do it I remember...) but not so much anymore...

I still would never install it on a DC personally...

Just install it on any other member server.

 

I remember a few years back the IT company I worked for asked me to look at a clients DirSync issue and I found that our second line team in order to get around not being able to install DirSync on a DC added the Hyper-V role and then spun up a VM on the clients DC just for DirSync... I laughed... then cried... then proceeded to go on a major shouting spree about running Hyper-V on a DC and the performance impact, this was during 08-R2 days.

[Michael]

The following Powershell script works for me adding ProxyAddresses for all users:

 

$users=import-csv C:\tools\SMTP.csv
foreach($user in $users){
$u = Get-ADUser $user.name -Properties mail,department,ProxyAddresses
$u.ProxyAddresses = $user.ProxyAddress -split ';'  
Set-ADUser -instance $u 
}
PAUSE

 

SMTP.csv should read:

 

Name	ProxyAddress
User1	SMTP:[email protected];smtp:[email protected];smtp:[email protected]
User2	SMTP:[email protected];smtp:[email protected];smtp:[email protected]

 

SMTP (CAPS) meaning Primary and smtp (lower), optional alias.

[cygnes]

Firstly many many thanks for all your suggestions and comments, they were all very helpful.

 

After Microsoft not being very helpful (only working on the symptoms), after digging a little deeper, and actually opening my eyes i noticed that there was a typo (how this got there i have no clue) with the UPN, it was spelt "school.county,sch.uk".. yeah i didnt spot it straight away, i managed to find a script that i'll post below that changed them.

 

How that got there i have no idea, because there was no entry on the DC in UPN Suffixes, (if anyone has any ideas how i can check this and remove it for good that would be great?)

 

Import-Module ActiveDirectory

$oldSuffix = "school.county,sch.uk"

$newSuffix = "school.county.sch.uk"

$ou = "OU=School,OU=Establishments,DC=DC,DC=internal"

$server = "DC Server"

Get-ADUser -SearchBase $ou -filter * | ForEach-Object {

$newUpn = $_.UserPrincipalName.Replace($oldSuffix,$newSuffix)

$_ | Set-ADUser -server $server -UserPrincipalName $newUpn}

 

saved the above as a .ps1 file and ran it after changing the $Suffixs and $OU and $Server.

 

Regarding the Azure AD Connect i'll install that on another server i think after your advice on here.

 

Cheers Chaps !

Edited February 21, 2017 by cygnes