How do I manually force a password sync between AD and 365

[maxrebo]

365 User, AD sync to 365 using MS Entra connect Sync, any password changes in ADd only seem to sync every 30 minutes, is there a way to manually sync this, I recall there's a way via Powershell?

 

Thanks

[maxrebo]

Just to add to this, my DCs are still 2012 R2, (I have a new 2022 VM ready to transfer roles) will it still sync ok now that support has ended for these?

[Steve21]

Passwords are on a different two minute cycle

 

The main 30 min one can be forced with start-adsyncsynccycle -policytype delta

 

Steve

[maxrebo]

Passwords are on a different two minute cycle

 

The main 30 min one can be forced with start-adsyncsynccycle -policytype delta

 

Steve

 

Strange.

Is there somewhere I can find if the password sync is working correctly? over half an hour after the AD password change and still using the old one.

 

Azure AD Connect (on 365 admin) says both are syncing correctly.

[Boredguy]

You are running version 2 of the Entra Connect/Azure AD Connect, and not still on version 1 on the 2012 server.

 

You might be best to export your current schema from Entra Connect, and install a new version of the client on a 2019 or higher server.

 

https://admin.microsoft.com/Adminportal/Home#/dirsyncmanagement will show you when your last password sync was

[maxrebo]

You are running version 2 of the Entra Connect/Azure AD Connect, and not still on version 1 on the 2012 server.

 

You might be best to export your current schema from Entra Connect, and install a new version of the client on a 2019 or higher server.

 

https://admin.microsoft.com/Adminportal/Home#/dirsyncmanagement will show you when your last password sync was

 

Thanks.

Any guides on how to do this? (sorry not familiar too much with the Sync tools)

 

Regards

[maxrebo]

So I have Version 2 AAD Connect on my 2016 Domain controller.

The password sync https://admin.microsoft.com/Adminpor...syncmanagement is syncing from my 2012R2 server.

 

How do I tell it to sync from my 2016 v2 AAD?

[Boredguy]

If you already have a copy running on a 2016, you can stop the version on the 2012 server as long as both are configured the same.

 

You generally only need 1 copy of it running on your network at any one time otherwise it gets confused.

[Olliedawg]

If are are running version 2 on a 2016 server that should be OK. Only have 1 instance of AAD connect running at a time otherwise you will have problems.

 

You could try export the config, and reinstall the connect tool

[maxrebo]

Ok, understand it a bit more now..

 

Yes, it seems I have a v1.1 running on the 2012R2 and a v2.2 running on my Server 2016.

So if I stop the 2012R2 version (within the Synchronisation service manager) will Azure Ad Connect in 365 start using the v2.2?

[Olliedawg]

Ok, understand it a bit more now..

 

Yes, it seems I have a v1.1 running on the 2012R2 and a v2.2 running on my Server 2016.

So if I stop the 2012R2 version (within the Synchronisation service manager) will Azure Ad Connect in 365 start using the v2.2?

 

Yea scrap the AD connect tool running on the 2012 R2 server.. reached EOL now. Decommissioning Azure AD Connect V1 | Microsoft Learn

 

I think your main issue is stemming from having two instances of the connect tool running. I'm sure you can just copy the config using the GUI, although if you already have a newer version running you shouldnt need to do this

Edited November 3, 2023 by Olliedawg

[TheRobins]

If I create a new AD object and want to it create instantly, open powershell as admin and run.

 

Start-ADSyncSyncCycle -PolicyType Delta

 

Does it for me without having to wait.

[Mako]

Not to derail the topic but if your estate is large enough, it is a good practice to have a secondary instance set up in staging mode. We have this here in case our primary site goes down. If you are a single school and/or only have a few servers, probably not necessary. This is also just a good read in general.

 

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-topologies

[maxrebo]

Yea scrap the AD connect tool running on the 2012 R2 server.. reached EOL now. Decommissioning Azure AD Connect V1 | Microsoft Learn

 

I think your main issue is stemming from having two instances of the connect tool running. I'm sure you can just copy the config using the GUI, although if you already have a newer version running you shouldn't need to do this

 

Ok, So I've moved the AD sync to my 2016 server, changed the staging modes between old and new server. so I think, the new server is updating to 365.

in 365 admin I'm getting updated syncronisation from AD but would like to make sure its from my 2016 Server.

How do I stop my old server syncing with 365?

I've stopped (disabled) the AzureADConnectHealthSyncMonitor x 2 services on the old server but it keeps syncing via the Synchronisation Service manager.

 

Thanks

[Mako]

If your old server is now in staging mode then it won't be sending data to 365.

 

If you've just made this change then it might take a while for 365 admin to show the new data source.

[maxrebo]

If your old server is now in staging mode then it won't be sending data to 365.

 

If you've just made this change then it might take a while for 365 admin to show the new data source.

 

Thanks. Just tested and all seems to be working.

 

Last question - In my previous school, as NM, for those accounts synced with our on prem AD, in 365, we couldn't change their passwords (from 365), (it informed us that this account is synced with your on-Prem and reset it from there)

We dont currently have this enabled and can reset password in 365 using the reset password link.

How do you enable this?

[Olliedawg]

As above 365 takes a little while to reflect the changes. I would also put AAD connect in staging mode to ensure it is not synching data to 365.

 

Then its just a case of waiting & checking the sync status in 365

[Mako]

Is Password Writeback enabled as part of your Entra Connect sync options? If so, disable it.

 

You can also head to https://entra.microsoft.com/ -> Protection -> Password reset -> Properties -> Set "None" for Self service password reset to disable users from resetting their own passwords online.

[maxrebo]

Still having problems with Syncing.

Old server is in staging mode, so it shouldn't be a problem.

New server runs a sync with Success so nothing looks wrong.

 

What are the service I need to stop to stop the old server running a sync. Just want to rule this old server being the problem.

 

thanks

[HPlum78]

What is the sync service saying on the servers? only one should be (will be) exporting to the tenant connector (the one in staging mode will only be doing the delta's), also not sure that running v1.x and 2.x is supported but not looked it up.

[Olliedawg]

The old one in staging mode will not be synching, that's the point of staging mode. What problems are you having?

[HPlum78]

No the one in staging mode will not be exporting, it will (should) be syncing. Edited November 9, 2023 by HPlum78

[HPlum78]

Just stopping the services on the server will just cause you more/ different issues and you need to clean the components up properly.