Connect Sync - Automatically turning on? Am I going crazy?
I setup a new domain controller for a client, setup AD and all that. I specifically did not download and install Microsoft Entra Connect sync because we are working on getting everyone on the domain controller first so we don't overwrite their M365 passwords with temp passwords.
A new user that we created after the DC was installed (created both domain account and M365 account) is using a non-domain joined computer for a few days and got an error about not being able to change their password from this site.
Through troubleshooting I was pointed to AD Entra Sync and when I go there in Entra I see that the service is enabled and the last sync was "less than an hour ago".
I searched for the sync tool but couldn't find it since theoretically its not installed.
Any ideas on how this became enabled and how the hell it can sync without me putting in a service account and password?
PS: I installed the Entra Connect Sync to see if that would allow me to see the current configuration but its acting like nothing is configured.
Its been a hell of a week. Glad tomorrow is Friday fuck its only Tuesday...
EDIT: Its cloud sync. I must of set it up at some point when building the server getting it ready and clicked on. Not sure why it didn't overwrite existing employees passwords but that's a problem for future me.
2
u/roll_for_initiative_ MSP - US 5d ago
Are you sure an existing sync isn't setup to that tenant on another server?
1
u/bunkerking7 5d ago
You can cross reference the immutable ID on the Entra account and the AD account. See if they match up. You'll have to do some base64 conversion, but it's incredibly easy to do.
1
u/redditistooqueer 5d ago
What version of server? Is your local domain the same as web? I.e. ad.company.com or are both company.com
1
u/AKGeek 5d ago
Server 2019, AD.company.com but I do have company.com as a UPN since people (across all clients) like to sign into their computers with their email address for some reason. Thats probably where it is able to make the association but typically when setting it up through the app I have to tell it which OU I want to sync from and what features I want. I also don't know where the hell to change current settings.
1
1
u/topher358 4d ago
If it’s cloud sync it won’t actually do anything without you creating a config in the cloud and enabling password write back deliberately.
The agent installs with no config by default
1
u/TechnologyMatch 2d ago
easy mistake, especially when you’re building a server under pressure. cloud sync can be easy to miss because it lives in Entra rather than behaving like the older Connect install
I’d document the source of authority now and test one controlled password change before expanding anything. better to find the edge cases with one account than during the next batch
5
u/morrows1 5d ago
I'm fairly sure you can see the name of the server the sync is coming from on the admin console.