OneDrive Mapping and ADConnect

[coreykeeling]

Morning,

 

Our school is looking to migrate a network share over the summer holidays with the possibility of migrating most of our file storage to Office 365. I am looking for some advise after doing some research.

 

I know that I can use Azure AD Connect to sync my local AD to Office365 and have seamless sign on but our internal domain uses a .internal address so I know I need to link them. I have read the following article from MS https://docs.microsoft.com/en-us/office365/enterprise/prepare-a-non-routable-domain-for-directory-synchronization that says I need to change the suffix to my routable domain e.g example.com if I do that will it affect how users login to there computers?

 

Second how would I go about creating a mapped drive? I have read that there is a script by Jos Lieben but it can be slow as it uses WebDev. Some people on here have recommended the OneDrive client with Files on Demand but how do you turn this into a network drive so that our users don't notice anything different? I have also been told that MS Teams can be better used for a network drive over SharePoint which is harder to manage.

 

 

Appropriate any help.

 

Corey

[oapscarface]

Hi Corey

 

We're still on the road to migrating our main server shares, I won't bore you with our process but to help you with your main question I created a blog a while back in which I;ve tried to put everything you need to get going - https://middletonhome.wordpress.com/2018/11/28/onedrive-ondemand-sso/

 

For the domain question, SSO works by matching the users username in AD with that in o365, you are correct, changing the domain suffix in AD 'should' have no affect on users logging into Windows but it depeneds on whether you other systems that use the whole UPN from AD rather than just the username, I can't think of any systems off the top of my head that would. Adding an additional suffix and changing it in AD to start with should be fine.

 

Your second question, it sounds like you might be getting confussed between OneDrive and Sharepoint, but I might be missreading, for a server share you'd really be wanting to use Sharepoint and not OneDrive, that said, OneDrive can show a SharePoint library in File Explorer BUT it wouldn't be mapped. Personally we've tried both Jos' solution and I Am Clouds solutions, both of which essentially use WebDav but it's REALLY cluncky, it may mean you have a mapped drive letter but in use, working on files larger than 10MB (trust me in a school you'll have more than you think) can be painful. OneDrive On Demand is your best bet.

 

We've moved most of our 6000 users over to it now, most are now used to seeing files in OneDrive and we're just starting to move our SHarePoint document libraries over to the OneDrive app and having them show in there, although I am currently working on how to get that to automatically show these sites on login, at the moment people have to show the document library in a web browser and select Sync to have it show in File Explorer.

 

Hope that helps.

[jmak]

The proper solution is on its way:

 

https://docs.microsoft.com/en-us/onedrive/use-group-policy#configure-team-site-libraries-to-sync-automatically

 

Currently only for people on the insiders build, but they seem to have something that actually works. Still about 2 years behind Google though.

 

On the plus side, once you have files on demand running it's reliable. Personally I'm not a fan of the Teams interface - there are advantages if your whole team is desk based - you can cut out a lot of emails - and if you use almost exclusively MS Office file formats. Support for anything else is dire - you can't even open PDFs to view. If you "open" files that aren't supported, they just download and you then have to find somewhere local to save them and then manually upload. Also every time you open it, it defaults to conversation view and it's an extra click to actually view the files. Our users generally open the Team once, click "open in SharePoint", then click "Sync", at which point OneDrive does its stuff and the files appear in Explorer (and context menus) and they open in the application associated with the file type.

 

From the point that the SharePoint library is synched, the user experience is very similar to having a network share, however it's definitely not transparent, so it will need to be explained in detail.

 

My preferred solution was to create a SharePoint webpage with a link to each of the libraries and set it as a homepage/startup page. Users can then easily go straight to the SharePoint library and for anything they want to synch, it's then a one off single click. You could potentially put links in the start menu if you want to avoid users even having to open a browser.

 

The other thing I would say is that by making the experience as seamless as possible, you could miss out on some big benefits of cloud storage. File sharing is much more effective than either saving copies on a network share or emailing attachments and it users adopted the better practice because they saw the benefits for themselves. If you can identify benefits for users, they will be much more patient with the changes/inconveniences.

Edited July 2, 2019 by jmak

[coreykeeling]

For the domain question, SSO works by matching the users username in AD with that in o365, you are correct, changing the domain suffix in AD 'should' have no affect on users logging into Windows but it depeneds on whether you other systems that use the whole UPN from AD rather than just the username, I can't think of any systems off the top of my head that would. Adding an additional suffix and changing it in AD to start with should be fine.

 

That is great! Did you have to edit anything in Active Directory so that Azure AD Connect knows how to match AD Users with Office 365 users? Our AD usernames are [firstinital][surname] and our Office 365 is [firstname].[surname]? I am thinking I have to add there email addresses to the mail attribute in AD.

 

We've moved most of our 6000 users over to it now, most are now used to seeing files in OneDrive and we're just starting to move our SHarePoint document libraries over to the OneDrive app and having them show in there, although I am currently working on how to get that to automatically show these sites on login, at the moment people have to show the document library in a web browser and select Sync to have it show in File Explorer.

 

Have you migrated there home drives and if you did how did you do it?

 

 

Thanks for advice @jmak and @oapscarface

[coreykeeling]

I have found a Microsoft article which answers my own question about preparing Active Directory for Azure AD Connect.

https://docs.microsoft.com/en-us/office365/enterprise/prepare-for-directory-synchronization

 

I have one more question which might be too complicated.

 

We have one Office 365 tenant which is shared between two schools on there own AD domain. 5 users will be in both ADs is there anyway we can link both of them to the same email address so both can benefit from SSO on either site?

[sted]

I have found a Microsoft article which answers my own question about preparing Active Directory for Azure AD Connect.

https://docs.microsoft.com/en-us/office365/enterprise/prepare-for-directory-synchronization

 

I have one more question which might be too complicated.

 

We have one Office 365 tenant which is shared between two schools on there own AD domain. 5 users will be in both ADs is there anyway we can link both of them to the same email address so both can benefit from SSO on either site?

unless the local networks are part of the same domain/forest you cant sync them. as far as im aware ad connect is single domain/forest to cloud you cant sync school1.local and school2.local to one 354 instance

[chrisjako]

Have you migrated there home drives and if you did how did you do it?

 

Use the sharepoint migration tool for this https://docs.microsoft.com/en-us/sharepointmigration/introducing-the-sharepoint-migration-tool

 

Do a csv so the you can use the JSON/CSV import option, column A wants to be your home area unc paths, B and C leave blank, D is your onedrive path, E is "Documents"

 

example

 

 

 

before you do the above you will have to give admin rights to the default admin tenant for O365 on everyone's onedrive account so that you (as admin) can upload files to their accounts, use the same login for the sharepoint tool as you do for the script below

 

Just change lines 22/23/25/26 to your o365 credentials

 

########
#ODFB Rights Administration
#Copyright:     Free to use, please leave this header intact
#Author:        Jos Lieben (OGD)
#Company:       OGD (http://www.ogd.nl)
#Script help:   http://www.lieben.nu
#Purpose:       Give an administrator rights on all Onedrive for Business accounts
########
#Requirements:
########
<#
Powershell 4
.NET 4.5
Sharepoint Online Management Shell (X64)
http://www.microsoft.com/en-us/download/details.aspx?id=35588
Sharepoint Server 2013 Client Components
http://www.microsoft.com/en-us/download/details.aspx?id=35585
run “Set-Executionpolicy Unrestricted” in an elevated powershell window
Windows 7+ or Windows Server 2008+
#>

$o365login     = "[email protected]"           #Username of O365 Admin
$o365pw        = "PASSWORD"                                        #Password of O365 Admin
$logfile       = ($env:APPDATA + "\ODFB_BP.log")	       #Logfile in case of errors
$spAdminURL    = "https://TENANT-admin.sharepoint.com"    #URL to your SP Admin site
$spMyURL       = "https://TENANT-my.sharepoint.com"       #URL to your SP MySites


#Start script
ac $logfile "-----$(Get-Date) ODFB_RA v0.1 $($env:COMPUTERNAME) Session log-----`n"

#build Credential Object
$secpasswd = ConvertTo-SecureString $o365pw -AsPlainText -Force
$Credentials = New-Object System.Management.Automation.PSCredential ($o365login, $secpasswd)

#Load sharepoint module
try{
   [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client") | Out-Null
   [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime") | Out-Null
   [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.UserProfiles") | Out-Null
}catch{
   $errorstring = "ERROR: Failed to load Sharepoint Libraries, exiting"
   ac $logfile $errorstring
   Write-Host $errorstring
   Pause
   Exit
}
#load SPOnline module
$env:PSModulePath += ";C:\Program Files\SharePoint Online Management Shell\"
try{
   Import-Module Microsoft.Online.SharePoint.PowerShell
}catch{
   $errorstring = "ERROR: Failed to load Sharepoint Online module, exiting"
   ac $logfile $errorstring
   ac $logfile $error[0]
   Write-Host $errorstring
   Pause
   Exit
}

#Build sP credential object
$creds = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($o365login,$secpasswd)

#build proxy
$proxyaddr = "$spAdminURL/_vti_bin/UserProfileService.asmx?wsdl"
$UserProfileService= New-WebServiceProxy -Uri $proxyaddr -UseDefaultCredential False
$UserProfileService.Credentials = $creds

$strAuthCookie = $creds.GetAuthenticationCookie($spAdminURL)
$uri = New-Object System.Uri($spAdminURL)
$container = New-Object System.Net.CookieContainer
$container.SetCookies($uri, $strAuthCookie)
$UserProfileService.CookieContainer = $container
try{
   $UserProfileResult = $UserProfileService.GetUserProfileByIndex(-1)
}catch{
   $errorstring = "Critical error, unable to get profiles"
   ac $logfile $errorstring
   ac $logfile $error[0]
   Write-Host $errorstring $error[0]
   Pause
   Exit
}
$NumProfiles = $UserProfileService.GetUserProfileCount()
$i = 1
$ProfileURLs = @()

Write-Host "Begin discovery of $NumProfiles profiles"
While ($UserProfileResult.NextValue -ne -1) 
{
   Write-Host "Checking profile $i of $NumProfiles"
   $Prop = $UserProfileResult.UserProfile | Where-Object { $_.Name -eq "PersonalSpace" } 
   $Url= $Prop.Values[0].Value
   if ($Url) {
       Write-Host "Adding $Url to the list"
       $ProfileURLs += $Url
   }
   $UserProfileResult = $UserProfileService.GetUserProfileByIndex($UserProfileResult.NextValue)
   $i++
}
Write-Host "Finished discovery of profiles"

Write-Host "Connecting to Sharepoint Online"
try{
   Connect-SPOService -Url $spAdminURL -Credential $Credentials
}catch{
   $errorstring = "Critical error, unable to Connect to Sharepoint Online"
   ac $logfile $errorstring
   ac $logfile $error[0]
   Write-Host $errorstring $error[0]
   Pause
   Exit
}

Write-Host "Start processing profiles"

foreach($profileURL in $ProfileURLs){
   $fullPath = "$spMyURL$profileURL".TrimEnd("/")
   Write-Host "Processing $fullPath"
   try{
       Set-SPOUser -Site $fullPath -LoginName $o365login -IsSiteCollectionAdmin $true
       Write-Host "$o365login permissions added to $fullPath"
   }catch{
       $errorstring = "Failed adding $o365login permissions to $fullPath"
       ac $logfile $errorstring
       ac $logfile $error[0]
       Write-Host $errorstring $error[0]      
   }
}

ac $logfile "Script finished"
Write-Host "Job Finished"
Pause
Exit

[supportman]

Don't use Webdav, we tried this and it was unusable sadly.

[coreykeeling]

unless the local networks are part of the same domain/forest you cant sync them. as far as im aware ad connect is single domain/forest to cloud you cant sync school1.local and school2.local to one 354 instance

 

It is possible now as the AD sync tool supports multiple forests but with a single sync server so you do have to have a connection between your forests.

[sted]

It is possible now as the AD sync tool supports multiple forests but with a single sync server so you do have to have a connection between your forests.

 

any info on this (i assume if i had domain a/b/c as different schools and had a domain d somewhere if i trusted those domains i could sync them all from domain d?)

[coreykeeling]

This is the Microsoft article I used. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies

 

Wherever you install the Azure AD Connect tool it must be accessible to all forests you want to sync. I didn't need to add any trusts between forests. The client will ask for your domain credentials for each forest and will then create a sync account.

 

The only issue I am currently having is that if some users are in multiple forests then SSO will only work in one of the forests. If anyone can help with the issue I would appropriate it.

 

 

Sorry Sted, I also followed this article https://www.itprotoday.com/iaaspaas/syncing-multiple-forests-azure-ad

Edited July 9, 2019 by coreykeeling
added additional website

[coreykeeling]

For schools that are using OneDrive how do users access the OneDrive folder? We block the C: drive so during my testing they couldn't access OneDrive folder on the machine.

[chaplic]

unless the local networks are part of the same domain/forest you cant sync them. as far as im aware ad connect is single domain/forest to cloud you cant sync school1.local and school2.local to one 354 instance

 

You absolutely can sync more than one AD into a single O365, and you can have either party with a shared email address, though there are caveats and the 'other' party cant have that email address on-prem, if you're in hybrid.