As of 11/11/2014, Microsoft has released their next generation tool for providing synchronization between an on-premise Active Directory environment and Microsoft based cloud service (Azure, Office 365 Suite (Lync Online, CRM, SharePoint, Exchange, etc.)). The utility is now referenced as Microsoft Azure Active Directory Sync Services (AADSync).
In this tutorial, we will go over the process to ensure you are on the new generation of their synchronization tool. The process is fairly straight forward, uninstall the old DirSync utility, install the new AADSync utility. If you wish to install the utility on a new server, stop the DirSync service, install the AADSync utility on the new server, and then uinstall DirSync after you have verified synchronization is successful on the new machine.
Here is the uninstall DirSync and install AADSync process
- Download a copy of the AADSync utility from Microsoft's website: http://www.microsoft.com/en-us/download/details.aspx?id=44225
- Login to the server currently running DirSync
- Open up Control Panel
- Select Programs and Features (notice I am in the View By Small icons view)
- Uninstall the Windows Azure Active Directory Sync tool
- Select Yes to uninstall when prompted
- Uninstall Forefront Identity Manager Synchronization Service if it wasn't uninstalled already
- Run the MicrosoftAzureADConnectionTool.exe application you downloaded from Microsoft
- Check I agree to the license terms and click Install
- Once the install has finished, open up Computer Management and navigate to System Tools -> Local Users and Groups, Groups, and double click on ADSyncAdmins
- Ensure your user account, user group, or local machine has been added to the security group
- Log out of Windows
- Note: This step is needed to ensure you have proper user privileges when running the sync tool. When running through the sync tool's installer, your user account will automatically be placed in a local security group called ADSyncAdmins. A logout is needed to update your session otherwise you may receive the following error message:
Your account is not a member of the ADSyncAdmins security group. If you have recently installed Azure AD Sync, sign out before running this installation guide again.
- Note: This step is needed to ensure you have proper user privileges when running the sync tool. When running through the sync tool's installer, your user account will automatically be placed in a local security group called ADSyncAdmins. A logout is needed to update your session otherwise you may receive the following error message:
- Upon login, open up the DirectorySyncTool application
- Enter your Azure or Office 365 admin credentials and click Next
- Enter in your forest name, username (must be in domain\username format), and password (Active Directory on-premise credentials) and click Add Forest
- Note: If you are unsure what your forest name is, login to your domain controller and execute the following powershell command to list all forests in your deployment:
Get-AdForest | FT Name
- Note: If you are unsure what your forest name is, login to your domain controller and execute the following powershell command to list all forests in your deployment:
- Click Next once your forest has been validated
- Click Next on User Matching
- Check the boxes that are applicable to your deployment and click Next
- Click Configure
- Click Finish
Hello, Jack,
We are using DirSync, ADFS2.0 and Exchange 2010 Hybrid deployment and would like to know if I could upgrade DirSync to AADSync first, upgrade ADFS.20 to ADFS 3.0? or do they have to upgraded at the same time.
Thank you in advance.
Hi Sri T,
Actually, AADConnect was just announced yesterday, so I would encourage you to upgrade to that.
You do not need to upgrade to ADFS v3 in order to use the newer sync tools, you can still be on ADFS 2.0. If you are upgrading both, you can upgrade ADFS or DirSync, the other will not matter.
Jack
Hi Jack,
Thank you for this instruction. I have a question. We are currently running Dirsync in our environment. We would like to upgrade to AADSync, but install the service on a different server. Is this advisable, while uninstalling Dirsync from the old server.
Thank you
Hi Anthony,
I would advise installing Azure AD Connect as it will do an in-place upgrade from DirSync. It is not advisable to run both DirSync and AADsync/Connect at the same time.
Jack
Pingback: Azure AD login - "we are unable to connect right now"
Hi, when we run the upgrade from DIRSYNC to AD CONNECT we get a message "users will not be able to sign in with on-premise credentials"
We just want to continue to login with DOMAINNAME\username...
What is this message telling us...?, no one else seems to get it..
Thanks in advance
Hello,
In the new version of Azure AD Connect, it will check if your domain names on-premises ends with a non-routable name (such as .local). If it does, it is stating that you either need to choose alternateID or leverage a publically routable UPN suffix on-premises.
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-add-domain-concepts
Jack