Powershell Script to run Ad Sync

[maxrebo]

Hi,

I need to setup a way of allowing a user to update the Ad Sync between our on site AD and 365 quikcly (instead of waiting for it to update on cycle every 30 mins)

 

We (admins) do this from Powershell currently

 

Start-ADSyncSyncCycle-PolicyType Delta

 

This will be a staff user who will need this.

 

Is there a way of creating a powershell script for them to run after a password reset?

 

Sorry my PS skills are currently lacking!

[ThomL]

you could:

Enter-PSSession -ComputerName servername

 

from the users session and then try the:

Start-ADSyncSyncCycle-PolicyType Delta

 

See if the user has the permissions needed, if not you can create a credentials file pretty easy that powershell can use with Enter-pssesion to use an account that can open a remote session/start the sync. You could then set this up as a schedule task that users can trigger and then place shortcut on the users desktop that the user can double click that will start the scheduled task, which will launch the script and initiate the sync?

[mavhc]

PoSH Server might work

[mikkydoos]

You could change the sync frequency globally if appropriate...

 

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-scheduler

[ThomL]

If you do want to go with the idea in my last post, I think this should work:

 

Save this as a script and then run with PowerShell and it will prompt you for credentials - enter the creds you want to use to connect to the server and initiate the sync - this must be run from the users computer/session because of encryption of the file I believe:

 

#harvest creds from user input

$creds = Get-Credential

#save creds to file

$creds | Export-CliXml -Path $PSScriptRoot\cred.xml

 

 

This should be the script to connect to the server and start the sync that you will launch with a scheduled task using the creds from above:

 

#Get creds from file

$Credential = Import-CliXml -Path "C:\pathHere\cred.xml"

#Connect to server with saved creds

Enter-PSSession -ComputerName serverName -Credential $Credential

#Start sync

Start-ADSyncSyncCycle-PolicyType Delta

#Exit remote session

Exit-PSSession

#Alert user that sync is complete

Write-Host "`n`n***Office 365 Sync Initiated***"

Read-Host -Prompt "******Press Enter to exit******"

 

Then create a schedule task that launches the above script on demand and then create a shortcut on the users desktop and use this as the program to launch:

C:\Windows\System32\schtasks.exe /run /tn "TaskNameHere"

Edited December 17, 2020 by ThomL

[mavhc]

Right, install posh-server where you run the adsync commands.

 

Add this as a file called adsync.ps1:

@"



Sample Web Site Template - PoSH Server






Initiating Azure Sync
$(Start-ADSyncSyncCycle -PolicyType Delta) ok



"@

 

run Posh Server, and then on a computer navigate to http://ip:8080/adsync.ps1

 

That should start the sync

 

Check Program Files\PoSHServer\webroot\logs for errors

 

If you try to load it when it's running already you get a blank page and an error in the debug log file

[Steve21]

Hi,

I need to setup a way of allowing a user to update the Ad Sync between our on site AD and 365 quikcly (instead of waiting for it to update on cycle every 30 mins)

[sNIP]

Is there a way of creating a powershell script for them to run after a password reset?

 

Just to confirm, you do realise that 30 min cycle doesn't do passwords? They're on a separate 2 minute schedule for password updates that runs independently

 

If you have longer delays with password resets sync'ing it's more likely to be linked to AD replication timings etc depending on how it's being changed

 

Steve

[maxrebo]

Just to confirm, you do realise that 30 min cycle doesn't do passwords? They're on a separate 2 minute schedule for password updates that runs independently

 

If you have longer delays with password resets sync'ing it's more likely to be linked to AD replication timings etc depending on how it's being changed

 

Steve

 

No I didn't realise there was a separate one!. If that's the case then that will be fine.

[HPlum78]

I would like to unpick why you are having to poke the sync engine inside of the 30 mins (password hash updates aside)? I don't poke the sync engine outside of our normal identity provisioning that often on the thick wedge of 50k identities. In fact i guess its only when an identity is put in the compromised account group and the scripts kick off to disable everything and revoke the tokens that we use the command to kick of a sync in anger.