The following diagrams (PDFs) illustrate the 6 typical phases of a Power365 Premium Integration Project. Each topic is summarized in 6 steps.
During an Premium Integration Project, Domain Sharing may be used. These two diagrams outline those services and how they operate.
Binary Tree Power365 Directory Sync is built with Microsoft Azure. Our Software-as-a-Service (SaaS) platform is designed to handle a variety of directory synchronization scenarios to meet your coexistence and collaboration needs.
Power365 Directory Sync can manage simple AD to AD, Cloud to Cloud, and more complex scenarios including combinations of local and cloud mixed environments.
You will need 2 items to get started with setting up Directory Sync.
- The authorized account(s) that allow changes to your local and/or cloud directories
- At least one (1) local on-premises server to host the local agent (if applicable)
The following information provides details around the specific component requirements.
Power365 Directory Sync is a 100% SaaS platform but to commit changes to on-premises directories (if applicable) such as Active Directory, a local agent must be installed and configured.
You will need at least one Power365 Directory Sync Agent installed per forest (environment). You may have up to five agents per forest. Adding more agents can offer limited fault-tolerance and can improve synchronization throughput, especially for near real-time password synchronization.
Please Note: Directory Sync agents do not function with a proxy server configuration on the agent host.
Please Note: The Directory Sync agent should not be installed on a non-domain joined server.
Important Tip: If you are only connecting to Microsoft Entra ID, local agents are not required.
This local agent must meet the following minimum requirements:
- At least one (1) Windows Server 2016 or 2019
- Additional Windows servers may be deployed. Limit to 5.
- CPU: 4 Cores
- Memory: 4GB Free
- Disk: 40GB Free Disk Space excluding Operating System.
Note: The local agent must be configured on the Member Server for Modern Password Copy.
Important Tip: Do not install any local agents on AD domain controllers in a production environment.
This local agent must meet the following minimum requirements:
- Windows Server 2016, 2019, or 2022
- .NET 4.7.2 (will automatically be installed unless already present)
- TLS 1.2 or higher
All AD Functional Levels supported by Microsoft for a Microsoft Windows Server operating system listed below are supported for migration from/to Domain controllers running on that same Operating System. For example, Windows Server 2016 functional levels are supported on Windows Server 2022, Windows Server 2019, and Windows Server 2016. For full details see Microsoft’s documentation of Active Directory Domain Services Functional Levels in Windows Server on Microsoft Learn.
- NOTE: Windows Server 2003 functional levels are supported only on Windows Server 2016. That is, Microsoft does not support Windows Server 2003 functional levels on Windows Server 2019 or Windows Server 2022.
The following Windows Server versions are supported:
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Connecting to the Power365 Directory Sync web interface uses TCP port 443 (HTTPS).
- Agent connections are initiated by the agent and require port 443 access to Power365 Directory Sync SaaS application.
Agent connections to the DCs use ports 88, 135, 137-139, 389 (UDP), 445, 1027, 3268 and 49152-65535.
Copying SIDHistory is an operation initiated by the agent and performed by the domain controllers.
Source/Target Domain Controller FQDNs must be resolvable by each other.
Open TCP ports 88, 135, 137-139, 389 (UDP), 445, 1027, 3268 and 49152-65535.
- The agent installer will prompt for a domain account with permission to read and write on-premises Active Directory.
- An agent intended to sync all domains in a forest, must have access rights to all domains and objects used in workflows.
- When creating a new Cloud Environment, an account with the Global Administrator Role is required to grant permissions and establish a connection.
- An OAuth token will be used by the application to create two (2) PowerShell accounts which are used to read and update objects in the cloud.
- The accounts will have Exchange Administrator, User Administrator and Teams Administrator roles assigned in order to read and update objects in the cloud.
- The accounts being used do not require any Microsoft 365 licenses.
The following conditions must be met for Password Sync:
- ADMIN$ must be accessible on the domain controller from the Directory Sync agent server.
- The Password Sync functionality requires that either a domain admin role or built-in admin role be granted to the service account.
- Any third-party anti-virus program that prevents access the LSASS process may need to be updated with a whitelist entry for the Password Sync executable.
The RC4 encryption (Rivest Cipher 4 or RC4-HMAC) is an element of Microsoft Kerberos authentication that Quest migration products require to sync Active Directory passwords between Source and Target environments. Disabling the use of the RC4 protocol enabled makes password syncing between environments impossible.
Beginning on November 8, 2022 Microsoft recommended an out of band (OOB) patch be employed to set AES as the default encryption type. The enabling and disabling use of the RC4 encryption protocol has potential impact beyond the function of password syncing of Quest migration tooling and should be considered carefully.
A trust between that source and target domain is not required to populate SID History on target objects, but is required to make use of the SID History when attempting to access source side resources. Typically, a trust is created by establishing a Forest level trust, but can also be done as a domain trust.
The target account must have administrator permissions in the source domain. To enable this, the target account of the Power365 Directory Sync agent should be added to the source PDC's built-in administrator group.
Auditing of the source and target domain must be enabled. This can be enabled as a global policy for all domain controllers or as a local policy on the specific source and target DCs involved. To enable auditing as a local policy, go to gpedit.msc > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy and enable the “Audit account management” and “Audit directory service access” settings.
‘Account Management’ and ‘DS Access’ Advance Audit policies of the source and target domain should be configured if Advance Auditing are configured in the environments. These settings can be enabled as a global policy for all domain controllers or as a local policy on the specific source and target DCs involved.
- To enable advance audit policy for Account Management, go to gpedit.msc > Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Account Management enable Success and Failure audit for the below policies.
- Audit Application Group Management
- Audit Computer Account Management
- Audit Distribution Group Management
- Audit Other Account Management Events
- Audit Security Group Management
- Audit User Account Management
- To enable advance audit policy for DS Access, go to gpedit.msc > Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > DS Access and enable Success audit for the below policies.
- Audit Directory Service Access
- Audit Directory Service Changes
- Audit Directory Service Replication
Audit Detailed Directory Service Replication
An empty Domain Local security group must be created in each source domain and named {SourceNetBIOSDomain}$$$.
The HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\TcpipClientSupport registry key must be set to 1 on the source domain primary domain controller. You must restart the source domain primary domain controller after the registry configuration.
MigratesIDHistory permissions are required on the target domain. This is typically enabled for Domain Admins and Enterprise Admins, but can be enabled for a specific group or user by following the below steps:
Important Tip: For further guidance from Microsoft about Using DsAddSidHistory, click here.
• To create a workflow alert, simply have a valid SMTP address ready.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback 利用規約 プライバシー Cookie Preference Center