What is the mechanism behind ODM AD legacy password sync?
Right now, ODM AD password sync depending on the following settings:
1) "monitoring agent" is chosen in the source environment, Passwords, Password Monitor
2) "Allow password changes from other environments" is checked in the target environment.
3) User account is matched from source to the target
Please note that "source" and "target" environments are only indicating sync direction. In 2-way password sync scenario, both environments can be acting as a source and as a target. This also applies to the matching direction. Source domain user account may be matched to the target, but that doesn't mean that target user is matched back to the source automatically.
There are currently 2 ways to sync passwords: through the workflow and using a background sync process. It's important to note that workflow will not sync passwords if password-related options are not selected in environments. There are no specific password-related attributes in templates except unicodePwd, which will populate users password with the default one during user account creation only.
The background password sync is working like this:
- monitoring agent is monitoring source domain by reading usnChanged attribute of AD objects and comparing it to the same value in the backend SQL database for those objects (that were Read by workflow)
- once usnChanged is different, dirsync agent will perform a remote call to DC, BTpass binaries to perform password hash extraction. BTpass DLL is being injected into LSASS process for that purpose. This process will be recorded in pwlistener log files in the same BTpass folder in c:\windows\ on DC. DC is being accessed using \\<DC_name>\ADMIN$ share.
- extracted password hash will be compared to stored user's password hash in the SQL database
- if hashes are different, they'll be updated in the SQL database and passed to the target environment dirsync agent, following matching direction and whether "allow" checkbox is checked for the target.
- target dirsync agent will perform same actions with DC, BTpass binaries, this time applying changed password hash to the target user
Note: it's safe to delete BTpass folder on DC as it'll be recreated on demand. This is also used as a troubleshooting technique, when password sync is not working properly. Please make sure to stop dirsync agent service before deleting BTpass folder.
