-
タイトル
Considerations for active directory synchronization - when is a two-way synchronization needed? -
説明
Do I need a one-way synchronization or a two-way synchronization when configuring DSA sync job? When do I need a two-way synchronization?
-
対策
Excerpt from QMM Best Practices:
One-Way vs. Two-Way Directory Synchronization
In most cases, you only need one-way directory synchronization to be established between the source and the target domain and directed from source to target. This is the case, for example, when you migrate objects in groups to the target domain while continuing administration only on the source (make changes only to source objects) during the whole coexistence period. One-way directory synchronization ensures that all changes made to the source objects (such as passwords and group membership) that have been migrated to the target are replicated to the target directory.
However, sometimes two-way directory synchronization is needed. This is the case when two production directories are merged (for example, when two different companies merge), administration is performed on both sides simultaneously, and you want changes made to the objects on either side to be replicated to the other side.
In most scenarios one-way synchronization will suffice.
The common misunderstanding is that a two-way synchronization is needed to be able to synchronize Free Busy information, etc.This is incorrect, only the one-way sync is needed.
There is however, a situation when having a two-way synchronization is absolutely needed.
If target domain is in use and administrative work occurs in target domain, for example, if Admins started to create new user accounts in target domain; then the newly created accounts are wanted to be present in the source domain so source users can view them in the GAL, can select them for group membership, send them e-mails, etc.In this case an agreement can be made to only create new objects in a particular OU in the target domain. Then this target OU with newly create target accounts can be included in target scope and the objects can be synced to source domain. As soon as any OU is selected in target domain the synchronization job automatically becomes a two-way synchronization.
Important: When synchronizing from target to source, in the source domain a new object is created and the object is immediately being "set to forward or redirect mail" (switched), which means that the "targetAddress" attribute will be populated and redirection addresses (plus x500) addresses will be "stamped".
This information will be stored inside the ADAM database so even if one decides to clean up the source object, the DSA will immediately re-populate the targetAddress attribute again and "switch" the user again.
If a mistake is made and a regular (existing in the source domain) user has been included in a two-way synchronization, then the DSA could switch the user and set the targetAddress attribute for the existing (active) source user and disrupt e-mail redirection. That's why it is so important to plan and implement this change very carefully.Note: Quest Technical Support does not provide any assistance when creating or configuring the synchronization scope; there is no official recommendation or suggestions; this article is more of an informative character. To approve your plan or decide about the migration strategy please contact your Account Manager at Quest, who can assist with bringing on board Professional Services or consultants.