AD connect

[MS2011]

We have one dc setup with AD connect. We don’t have replication of the ad connect server.

 

There is custom setting on our on prem ad connect setup causing not able to initially sync any device from our on premises ad to entra Id.

 

This is also preventing us from hybrid joining any devices.

 

We moving from sccm to intune.

 

Making changes to only one ad connect server cause if issue ?

 

Do we need to setup secondary ad connect server so any changes can be tested ?

 

Thanks

[Roberto]

It’s ‘good practice’ to set up an additional AD Connect server in staging mode but it is not essential. In both cases (second server or not), I’d say you want to export the config of the AD Connect server - there’s an option in the AD connect configuration wizard that makes this super easy.

 

This export of the configuration will make it easier to recover whether you stick with just one AD Connect server, or ensure any additional servers have the same settings as the primary, because either way you import the backup/export config during setup…

 

Secondary server needs to be in staging mode because this is a ‘read only’ mode that imports data from the directories and shows you what it would do without actually doing it; only one AD Connect server should be ‘live’ at any one time.

 

So to make your change to include devices in the sync, run the AD Connect configuration wizard, export the current configuration, then you should be safe to make your change with a few options to roll back if it turns to custard.

 

If I remember correctly (it’s been a while…), you can test device sync by choosing only to sync certain OUs during the wizard’s OU filtering step and placing test devices in that OU. I know this works for users and I think it works for devices too.

 

Edited March 27, 2024 by Roberto

[MS2011]

Many thanks for your reply, having issue with sync on prem device to entra ID.

 

We need to make following change

 

Attribute - cloud filtered-true to false or none

 

But i don’t know what impact on the rest of the service if i make this change.