Step-By-Step: Enabling Azure Active Directory Domain Services Password Synchronization

  • Article

Once the Azure Active Directory Domain service has been enabled, the next step is to sync the credentials to the Azure AD domain services. User will then be able to use their logins to log in to the managed domain services. This Step-By-Step post will detail how this can be enabled in both a cloud-only environment as well as in hybrid setup.

 

Cloud-Only Setup

Users in a cloud only setup will be required to change their passwords. A credential hash is created once user resets their password which is used by Azure AD Domain services for Kerberos and NTLM Authentication.

This can be enforced in two ways:

1)    Force password reset – in the console we can reset the password for user. It will generate temporally password for the user. So in next login, user need to provide new password.

To do this, log in to Azure AD instance (which is enabled with Azure AD Domain services) and then click on users tab.

pass1

Then select the user to reset the password and in the bottom click on RESET PASSWORD button

pass2

pass3

2)    Change Passwords from use logins – By login in to the Azure portal, users can reset their passwords. (https://portal.azure.com)

Once user log in to the portal click on the right hand corner where user name displays and then click on “change password”

pass4

pass5

 

Hybrid Setup

If you have on-premises AD and sync it already with Azure AD, we need to sync credential hashes required for NTLM and Kerberos authentication via Azure AD Connect. These are not sync with azure ad by default.

First thing first, if you have Azure AD connect installed in your servers, it need to upgrade with latest version. The latest recommended version is 1.1.130.0 – published on April 12, 2016 and can be downloaded here. This is important as older version of Azure AD Connect do not have this sync feature.

After upgrade (or new install) make sure the password synchronization is enabled. To do that,

•    Log in to the server which have Azure Ad sync installed (with appropriate permissions).
•    Double click on Azure AD Connect

pass6

•    Then in new window select the option “View current configuration” and click on “Next”

pass7

•    In next window check if the password sync is enabled

pass8

•    If not go back to the previous window and select option “Customize Synchronization Options” and click next 

pass9

•    Then under the “Optional Features” enable password hash synchronization.

pass10

With the install if use the express settings this is enabled by default. Also check if the synchronization happening without errors.

To check that go to start > azure ad connect > synchronization services

pass11

pass12

To do a full forceful password sync you can use following PowerShell script

$adConnector = "<CASE SENSITIVE AD CONNECTOR NAME>"
$aadConnector = "<CASE SENSITIVE AAD CONNECTOR NAME>"
Import-Module adsync
$c = Get-ADSyncConnector -Name $adConnector
$p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter “Microsoft.Synchronize.ForceFullPasswordSync”, String, ConnectorGlobal, $null, $null, $null
$p.Value = 1
$c.GlobalParameters.Remove($p.Name)
$c.GlobalParameters.Add($p)
$c = Add-ADSyncConnector -Connector $c
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $true

In here
$adConnector = "<CASE SENSITIVE AD CONNECTOR NAME>"
$aadConnector = "<CASE SENSITIVE AAD CONNECTOR NAME>"

Should replace with the info related to your setup, this can find using “synchronization services” window. Click the “connectors” tab.

pass13

Once it’s edited with relevant info it can execute.

pass14