On Demand Migration Current - Active Directory SID History Synchronization Quick Start Guide

Follow these steps to create two (2) new workflow for reading, matching, staging and writing data. 

1. Navigate to Workflows.
2. Click New.
3. Enter the Name and Description for the template. Click Next.
4. Select both the local Active Directory environments created previously. Click Next.
5. Select ONE-WAY SYNC. Click Next.
6. The workflow task wizard opens. It is a pre-configured set of workflow steps to facilitate the flow of objects and attributes between your directories.

   

   Step 1: READ FROM

   1. Click Select.
   2. Select both environments created previously.
   3. Click OK.

   Step 2: MATCH OBJECTS

   • In this step you decide how to match existing objects across your local Active Directories.
   • Matching is conducted by pairing sets of attributes to find corresponding objects
   • The two environments may already have some attributes that can be used to find similar objects between the different directories, or you may need to set some to ensure accurate matching
   • It is important that existing objects are correctly matched to perform SID History Synchronization.

   NOTE: Matching attributes should be reviewed and adjusted based on actual project scope; there isn’t a set matching rule that will fit all scenarios.

   1. Click Select.

      

   2. Select your source local environment from the drop-down menu.
   3. Select your target local environment from the drop-down menu.
   4. Choose your first attribute pairings, we will use WindowsEmailAddress for our first match criteria.
   5. Choose the sAMAccountName attribute for the source and target fields.
   6. To add more attribute pairs, click Add Attribute.
   7. Additional pairings are evaluated as “OR” conditions. After the first match is found, the additional pairings are not assessed.
   8. In our case we are adding three (3) additional attribute pairings to our criteria
      1. cn – This attribute was added to ensure we can match existing objects based on CN.
      2. UserPrincipalName – UPN was added to ensure uniqueness of the local part of the address string.
      3. Mail – This attribute was added to ensure we can match existing objects based on Mail.
   9. Ensure Match Across all object types is not checked in this case.
   10. There is no need in this guide to Add Another Pair, click OK to close this configuration.

   Step 3: STAGE DATA

   1. Click Select.
   2. Select the “Local to Local SID History Sync” template. Click Next.
   3. Select the source local environment as your source. Click Next.
   4. Select the target local environment as your target. Click Next.
   5. Select the default target domain name. Click Next.
   6. Click ADD OUS. In the OU pop-up window, select the OU that will be in-scope, check the INCLUDE ALL SUB OUS checkbox. Click OK to close the pop-up.

      

   7. Configure any Stage Data filter you like by double clicking the OU in the OUs list. It is highly recommended to setup the filter to limit the scope to perform a test on the first sync as part of the validation.  Click Next.
   8. Select the default OU for newly created objects for Users, Groups, Contacts, and Devices.  In our case, we can select the same OU for all object types as we are only syncing user as contact.

      

   9. Click Finish.

   Step 4: WRITE TO

   1. Click Select.
   2. Ensure the target environment is selected. Click OK.
7. When you are done with the workflow wizard, you are ready to schedule this workflow.
   1. Click Next.
   2. Select Manual for now and we can setup a sync schedule once the test sync has completed. 
   3. Click Next.
8. You can set up workflow alerts if needed. For now, click SKIP.
   1. Click Finish.

Follow these steps to create test objects in the source environment to validate the SID History Sync workflow.

1. Setup a User in the source local environment and ensure it is part of the OU filter setup for the Local Environment.
   1. DisplayName: Lab1SIDTest1
2. Setup a group in the source local environment it is part of the OU filter setup for the Local Environment.
   1. DisplayName: Lab1SIDGrp1
3. Capture the objectSid value for the above test objects for later use.

Follow the below steps to perform the SID History Sync workflow and validation.

1. Select the workflow configured and click RUN.
2. Allow the workflow execution to complete.
3. Validate Lab1SIDTest1 from source local Active Directory will be created in target. Source user’s objectSid will be copied to the target user’s SID History attribute.
4. Validate Lab1SIDGrp1 from source local Active Directory will be created in target. Source group’s objectSid will be copied to the target group’s SID History attribute.