365 AzureSync Permissions Fix- Export Errors

If you are using a local account rather than having MS created one from the wizard for better auditing and control. You may have to make some AD permissions changes via powershell. If you are seeing the following Export Errors:




Caution- you are modifying AD permissions to grant an account high level access. Do not use a regular user/admin account! Security best practices requires creating a separate service account that can be used exclusively for this process to allow proper auditing trail and security. 

I have found the following 3 commands give permissions needed to access the attributes:

$accountName = "Domain-Name\User-Name"

$ForestDN = "DC=Domain-Name,DC=Domain-Extension"
$cmd = "dsacls '$ForestDN' /I:S /G '`"$accountName`":WP;ms-ds-consistencyGuid;user'"
Invoke-Expression $cmd


accountName = "Domain-Name\User-Name"
$ForestDN = "DC=Domain-Name,DC=Domain-Extension"
$cmd = "dsacls '$ForestDN' /I:S /G '`"$accountName`":WP;msds-KeyCredentialLink;user'"
Invoke-Expression $cmd

accountName = "Domain-Name\User-Name"

$ForestDN = "DC=Domain-Name,DC=Domain-Extension"
$cmd = "dsacls '$ForestDN' /I:S /G '`"$accountName`":WP;msds-ExternalDirectoryObjectId;user'"
Invoke-Expression $cmd


You may need the following 3 settings to allow write back permissions from 365 to AD attributes:

Note: you may need to preinstall RSAT-AD Tools in Powershell:

Install-windowsfeature RSAT-AD-Tools

Set-ADSyncExchangeHybridPermissions -ADConnectorAccountDN ‘CN=Service-Account-name,CN=Service-Account-OU,DC=Domain-Name,DC=Domain-Extension’

Set-ADSyncMsDsConsistencyGuidPermissions -ADConnectorAccountDN  ‘CN=Service-Account-name,CN=Service-Account-OU,DC=Domain-Name,DC=Domain-Extension’

 Set-ADSyncPasswordWritebackPermissions –ADConnectorAccountDN ‘CN=Service-Account-name,CN=Service-Account-OU,DC=Domain-Name,DC=Domain-Extension’

 

Credit:
https://www.petenetlive.com/kb/article/0001636
https://www.azure365pro.com/hardening-azure-ad-connect-service-account/



 



Comments

Post a Comment

Popular posts from this blog

Office 365 Deployment Tool Office Download fails “Could not Install”

Image
Problem: you run the setup.exe /download download.xml and fails immediately with “Couldn’t install” You make sure all the settings are correct (see other blogs) and find nothing wrong Solution: Change drives and run it as an administrator again. For example above i am in the F:\OfficeDeploy directory which is the same directory I have the download.xml directing the download to. If i Change to the c: and run the same command again it works The Office Data folder was created and updated as shown below:
Read more

FRS to DFSR Post Cleanup “File Replication NtFrs Stopped”

Image
After successfully migrating from FRS to DFSR you get the File Replication NtFrs service is Stopped error on the local servers AD DS Services list. In the Event logs you may see Event id 13575 13577. You can confirm your migration completed by opening a cmd prompt as administrator and typing in: dfsrmig /getmigrationstate After your migration to DFSR is completed and you have given your servers ample time to propagate this service is no longer required. Since it is set to “Automatic”, as shown below” it shows in logs as a false positive error. Edit the File Replication Service and change it to “Disabled”, as shown below: Once it is listed as “Disabled” it will no longer show in the Console as an “error” Note : it may take some time to clear from the active view
Read more

Domain Migration SubinACL /Migratetodomain How To:

Caution : DO NOT run this on Domain Controller C:\ and only run on roaming profiles folders, or my docs shares day of migration to avoid ownership change issues. Confirm Domain trust is in place and users and groups have been migrated Test ping of olddomain.org from new domain Test ping of newdomain.org from olddomain Add newdomain.org domain controller host records to olddomain.org including reverse DNS records Confirm the user running the app is a domain admin in BOTH domains Download SubinACL here: http://www.microsoft.com/en-us/download/details.aspx?id=23510 /Migratetodomain- command will add the permissions of the new user to the old files and folders for example if jimbob@olddomain.org was migrated to the new domain jimbob@newdomain.org and you run the command below any file or folder in that path that has jimbob@olddomain.org will add Jimbob@newdomain.org with the exact same permissions. This is a safer way to migrate by keeping the old and new permissions intact while a
Read more