AD Sync accounts that have moved to another domain

[mrwoberts]

Managed to nearly give myself a heart attack today.

 

Background

School has two AD domains (admin.school and curriculum.school) and uses AD Connect to sync passwords to O365

Nearly all users are on the curriculum domain, with just the office staff still on the old admin domain, which I'm trying hard to get rid of.

 

Over the Easter break I rebuilt the office staff PCs and joined them with fresh accounts to the curriculum.school domain.

Pretty much everything has gone as planned, with the exception of the O365 AD Sync.

 

Currently the AD Sync tool is tuned in to both domains and was happily syncing user passwords to the cloud.

When I created the new users on the curriculum domain (you can see where this is going), the Sync tool had a fit, quite rightly, saying that there are duplicate email addresses (paraphrasing).

 

So, I thought to myself, I'll just remove the references to the email accounts on the admin domain - removed user email address, proxyaddress, and changed user logon 'domain' to be the plain @admin.school domain (was previously the email domain).

 

This unleashed a world of pain!

 

It created duplicate new users, renamed the old users (the original account where all their emails are) and promptly rejected any emails to the old account because they were now apparently destined for this new account.

 

After hours of panicking and frantically trying to undo this folly, the sync is now 'happy' pointing back to the redundant admin domain users, and the real user can now access their email as before, but clearly this setup is not helpful going forward.

 

Problem

How do I dig myself out of this hole and do this user sync-migration properly?

I would like to maintain the link (sync) for these handful of users that I've already moved over to the curriculum domain?

Otherwise I'm of a mind to totally disable the AD Connect and start from fresh (if that's even a wise idea, I honestly don't know)

 

Forgive me if my description of is not clear, my brain is totally fried and my nerves are shot to pieces

 

If you're going to reply to say that this is a 5 second fix, I truly do want to hear that, but at least give me some time before you lay that one on me

[johnpd]

You need the clear the immutable id- ive got a power shell script somewhere - three school domains migrated over many years also resulted in similar panic attacks [emoji23]

[johnpd]

If you delete the AD account and do an AD/Azure sync, Azure AD will automatically soft-delete the user and mailbox. Once soft-deleted, it will appear when you run this:

 

Get-MsolUser -ReturnDeletedUsers | ft UserPrincipalName

 

 

Use the UPN from that output in the code below:

 

$OldUserPrincipalName = (old UPN)

 

Restore-MsolUser -UserPrincipalName $OldUserPrincipalName

 

Set-MsolUser -UserPrincipalName $OldUserPrincipalName -ImmutableId ""

 

 

 

If you also wanted to change the UPN, you would do this….

 

Set-MsolUserPrincipalName -UserPrincipalName $OldUserPrincipalName -NewUserPrincipalName (new UPN)

 

 

Now you have an in-cloud account in Azure AD that is independent to AD but ready to be re-associated. Create an AD user account with the correct username, and don’t forget to set the right UPN. Finally, do an AD/Azure sync, and Azure AD will automatically match the AD user to the Azure user and make it an on-premises synced account, as long as the UPN matches and the ImmutableId was cleared.

 

Do all of this outside of that staff-member’s normal working hours, as it will impact them otherwise. You may need to wait a while for syncs etc.

 

This helpful advice was provided to me by an engineer who is worth every penny. If you ever need a recommendation for this type of work on mass I can let him know you are interested.

 

Thanks

John

[mrwoberts]

If you delete the AD account and ...

Just had a flashback from earlier today!

 

Let me just check I've understood you.

 

On the ADMIN domain

- delete the user (redundant user, but seems to be the anchor for the real email account)

- Wait for AD sync

- then Powershell, like my life depends on it, making sure that the Immutableid is photon torpedoed back to the 80s

 

On the CURRICULUM domain

- edit the user to add their email, proxyaddress, and point login domain to the school email address

- Wait for AD sync

- Update my will to leave all my worldly possessions to my pet turtle Felix

 

Does that sound right?

Edited April 26, 2019 by mrwoberts

[mrwoberts]

Just a further question.

 

What powershell command is recommended to force an AD/Azure sync?

[johnpd]

You want to run a delta sync but I’ve had a few beers now but it’s one line

[johnpd]

And yes what you describe is fine Edited April 26, 2019 by johnpd

[johnpd]

You should maybe create a fake account on admin and do the above as a test if it makes you feel better [emoji51] Edited April 26, 2019 by johnpd

[mrwoberts]

You should maybe create a fake account on admin and do the above as a test if it makes you feel better [emoji51]

 

That's exactly what I was thinking

 

Thanks for your help, I'll update you with my progress, although I may not attempt this remedy until I've recovered some courage :-)