To synchronize your AD Domain with your BPOS environment, follow the steps below.
- Log in on your Microsoft Online Services Administration Center, Click the [Migration] tab and then click the [Configure] button in the “Directory Synchronization” Section.
- Read the “Plan for Directory Synchronization” and check the checkbox, confirming that you read it.
- Press the [Enable] button in step 2, to enable BPOS for the synchronization.
- Press the [download] button in step 3. This will open a page where you can download the synchronization tool.
- Now you should install the synchronization tool, but mind the following restrictions:
– Supported OS: Windows Server 2003 Service Pack 2; Windows Server 2008
– Can’t be installed on a domain controller
– Can’t be installed on x64
– Powershell v1.0 has to be installed
- Execute the file you downloaded in the previous step (dirsync.exe).
– do not interrupt the installer
- The installation is a Next, Next, Finish installation. You will be staring at a progress bar for quite a long time
- After the initial install you can start the Configuration Wizard.
Before you proceed be sure, you have the following things:
– An user account who is an BPOS Administrator (probably the one you used to login with in step 1)
– An Enterprise Administrator Account
If you have these then the configuration is again almost, Next, Next, Finish.
- At the end of the configuration, choose “”Synchronize directories now”
– do not create any user object in your BPOS environment during this sync.
- Within a few minutes, you can then view your imported users in your BPOS environment, they are all imported under the “Disabled User“ view (Tab [Users] > [User List], under view select “Disabled Users”).
From here you can now enable the users. A bit annoying is the fact that the list doesn’t use paging, you can only go 1 step through the list or to the end (or is that because I only had 2 pages?)
So now some things that are interesting to know:
- The tool creates a service account named MSOL_AD_Sync. This will be a domain account with directory replication permissions on your AD.
- A service will be installed on your ”sync station”.
- The time needed for a synchronization depends on how many objects you have.
500 objects will take about 5 min. to sync the first time, after the about 30 sec.
1000 objects will take 10 min, after that 1 min.
500o objects will take 45 min, after that 5 min.
15000 objects will take 2.5h, after that 10 min.
All depending on your bandwidth of course, for more than 20.000 objects contact Microsoft.
- An uninstall of the tool, will not delete the MSOL_AS_Sync account, you have to do this manually.
- The tool will sync every user in your complete forest, so whenever you must delete a domain in your forest this will impact your BPOS environment. To delete the domain, you must complete some “in-between” steps.
- Every 3 hours there will be a scheduled sync.
This error will appear “049: LDAP injection characters were found in the user alias” if you have used invalid characters like & and !