I've setup RMUnify sync and I'm concerned.

[chazzy2501]

ok, so after installing ancient prerequisites like .net 2.0 and visual c++ 2010 on all 3 of my domain controllers. I was required to disable UAC.. So far, so bad. I then had installed the password sync tool on all 3 domain controllers. Then the kicker, ALL USERS must reset their passwords for it to work....

 

This tells me that rather than querying the AD database its stealing passwords as they sync between the DCs! This horrible fudge tells me that if they couldn't be bothered to get ad integration right what are the chances that they skimped anywhere else.

 

Are they salting and hashing credentials etc...

 

I love the note that passwords can't have the "£" symbol in them, so they are no sanitising correctly either. if this is the level of effort they put into the software, I want it out. Which is what I'm doing now.

 

 

if anyone whos used the M$ sync tool for O365 which can run on any normal domain member, this is the stark contrast.

[Katy]

Sounds the same as Google password sync? It sticks a DLL in that grabs the passwords as they are changed (there's a DLL that password changes run through which checks the complexity, you can create your own if you want very specific complexity requirements, assume they use this to grab it). Don't think anyone except MS have a way of taking the stored passwords?

 

But I'd agree with the rest of your concerns.

[bald_pig]

My understanding is you can't get the password from AD, whatever is authenticating salts and hashes your password, sends that to the ad server, and gets back either a token or an error code.

[Cache]

Although the RM Unify Sync instructions say that you need to disable UAC on the server, I just ignored that part and carried on - not had any problems I'm aware of.