dirsync Archives - Apostolidis Cloud Corner

How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario

Pantelis Apostolidis — Wed, 21 Jun 2017 10:32:34 +0000

How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario

Scenario objectives: We have an Exchange Hybrid setup between on-premises and Exchange Online (Office 365). All users are synced and the mailbox is located at Exchange Online.

We need to separate an existing mailbox from its user account and re-connect this mailbox to a new user account. If the mailbox in this scenario was located at the on-premises Exchange it would be an easy process just using the Exchange Management Console. But in a Hybrid scenario, the process includes many steps since the mailbox is not directory conencted to the Active Directory user account but it is conected to the Azure AD Synced User Account.

For the ease of the guide we will name the Existing User Account: OLDUSER and the New User Account: NEWUSER.

We will disconnect the Exchange Online Mailbox from the OLDUSER and connect it to the NEWUSER.

Step 1.

At the on-premises Active Directory, at an OU that is not synced with Azure AD, create the new user account. The “NEWUSER”. Ensure that you do not enter nothing at the email field. Just a user account with no email attributes.

Step 2.

Move the “OLDUSER” to an OU that is not synced with Azure AD

Step 3.

Run a Delta Sync. Go to the server that the AD Connect is installed, open the PowerShell and run “Start-ADSyncSyncCycle”

Step 4.

We need to get the GUID of the NEWUSER. To do so login to a Domain Controller, open PowerShell and run:

[system.convert]::ToBase64String((Get-Aduser NEWUSER).objectGUid.ToByteArray())

Copy the GUID to a Notepad

Step 5.

Open the Office 365 Admin Center and Restore the deleted user “OLDUSER”

Go to Users –> Deleted Users –> Select the user “OLDUSER” –>Click Restore

Step 6.

Connect to Azure AD and set the GUID of the “NEWUSER” to the Office 365 “OLD USER”. Details for connecting to Azure AD “https://technet.microsoft.com/en-us/library/dn975125.aspx“

Connect-MsolService

Set-MsolUser -UserPrincipalName olduser@mydomain.com -ImmutableId vMZGJpW6CUGY09bduJ5dlw==

Step 5.

Open the Office 365 Admin Center and Delete the old user “OLDUSER”

Go to Users –> Active users –> Select the “OLDUSER” –> click Delete user

Step 6.

Clean the on-premises Active Directory account of the old user “OLDUSER” from all attributes that will be added to the new user, like Proxy addresses, Target, address, Alias name, nickname etc.

Step 7.

Make the “NEWUSER” user account a Remote Mailbox object

At the on-premises Exchange, open the Exchange Management Shell and run:

Enable-RemoteMailbox -Identity NEWUSER -DisplayName "NEW USER" -RemoteRoutingAddress newuser@mydomain.onmicrosoft.com -Alias newuser -PrimarySmtpAddress newuser@mydomain.com

Step 8.

Move the “NEWUSER” to an OU that is Synced with Azure AD and run a Delta Sync like Step 3.

After that the “NEWUSER” active directory account will be connected with the “OLDUSER” Exchange Online mailbox and all attributes of the Exchange Online mailbox will be replaced with the “NEWUSER’s” values.

I suppose there are other ways, maybe easier, to accomplish this task, but following this process you will have the desired result without problems.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario appeared first on Apostolidis Cloud Corner.

Match OnPrem Active Directory users to existing Office365 Users

Pantelis Apostolidis — Fri, 29 Jul 2016 09:27:03 +0000

Lets say you have an Office 365 account and cloud only users with mailboxes and now you decide that you want to sync it and match the Office 365 users with your Active Directory users.

I prepared a lab with one DC and I created a trial Office 365 E3 account with custom domain. I created users with the same username to both. At Active Directory I set the UPN to match the Office 365 user name and also added the email address.

Next I enabled directory synchronization from Office 365 and installed Azure AD Connect to DC2. After the initial sync i got this error:

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [Mail test1@xxxxx.gr;].

I realized that Office 365 could not map the users, it was trying to create new. So there must be an attribute that needs correction. The solution came form the following blog:

http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

and specifically at the “manual match method” section:

In order to match the user with the cloud user you have to set the Immutable ID of onPremise Active Directory user’s ObjectGUID to the immutableID value of the Office365 user.
To retrieve the ObjectGUID you can use the following command:

Ldifde –d “CN=xxx…,OU=xxx,DC=xxxx,DC=xx” –f c:\temp\exportuser1.txt

“CN=xxx…,OU=xxx,DC=xxxx,DC=xx” is the distinguished name of the user. You can use ADSIEdit or the AD Users & Computer (attribute editor) to find this value

In the Textfile exportuser1.txt look for the ObjectGUID. You will find a string like z2Xbu0xFTUapOeDqHRTN1A==

Then connect to Windows Azure Active Director and use the command

set-MsolUser -UserPrincipalName user1.surname1@customerdomain.com -ImmutableId z2Xbu0xFTUapOeDqHRTN1A==

After that I just forced a delta sync “Start-ADSyncSyncCycle -PolicyType Delta” , the sync was successful and the users in Office 365 changed from “In Clout” to “Synced with Active Directory”

How to Map OnPrem Active Directory users to existing Office365 Users

source: http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

Pantelis Apostolidis

www.cloudcorner.gr

The post Match OnPrem Active Directory users to existing Office365 Users appeared first on Apostolidis Cloud Corner.

Alter the Office 365 DirSync Schedule

Pantelis Apostolidis — Tue, 17 Feb 2015 07:47:47 +0000

The DirSync by default runs every three hours. And you will realized that there is no GUI way to change that. To change the sync interval we need to change a configuration file.

1. Go to the below directory on your DirSync Server:

C:Program FilesWindowsAzureActiveDirectorySync

(there are two similar directories, one with spaces between the words and one without. We want the one without spaces)

Here we will find the main executable of the DirSync Scheduler, the “Microsoft.Online.DirSync.Scheduler.exe” and its assosiated Config file, the “”Microsoft.Online.DirSync.Scheduler.exe.Config”.

2. Open the “Microsoft.Online.DirSync.Scheduler.exe.Config” file using notepad

Find the line with key=”SyncTimeInterval”, the default is the below:

The “value” is the frequency of the schedule. The default “3:00:0″ means 3 hours.

We can change the value to what best fits our organization’s needs and based to how often we make changes to Active Directory. To reduce it to one hour change it to:

3. Once we finish changing the file, save and close it. Then go to the Services (services.msc) and restart the “Windows Azure Active Directory Sync Service” service, Service name: “MSOnlineSyncScheduler”.

Pantelis Apostolidis

www.cloudcorner.gr

The post Alter the Office 365 DirSync Schedule appeared first on Apostolidis Cloud Corner.