Home
%3CLINGO-SUB%20id%3D%22lingo-sub-814474%22%20slang%3D%22en-US%22%3ERe%3A%20The%20Mysterious%20Case%20of%20the%20%24%20(a.k.a.%20Dollar%20Sign)%20Character%20in%20Hybrid%20Azure%20AD%20Joined%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-814474%22%20slang%3D%22en-US%22%3E%3CP%3EHey%26nbsp%3B%3CSPAN%3EJorge%2C%20great%20post!%20Thanks%20for%20sharing.%20It%20gives%20a%20good%20insight%20into%20how%20sync%20rules%20work.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ESlightly%20off-topic%20but%20related%20-%26nbsp%3Bare%20you%20able%20to%20explain%20why%20sync'ing%20of%20computer%20accounts%20into%20Azure%20AD%20is%2Fis%20not%20required%20for%20Azure%20Hybrid%20join%3F%20Everywhere%20I%20read%20says%20'yes'%26nbsp%3B%20it%20is%20required%20but%20in%20my%20lab%20I've%20got%20computers%20that%20are%20not%20sync'd%20but%20have%20happily%26nbsp%3Bhybrid%20joined%20them%20selves%20to%20AAD.%26nbsp%3B%20SSO%2C%20password%2C%20reset%2C%20use%20of%20device%20conditions%20in%20CA%20polices%20etc.%20all%20seem%20to%20work%20just%20fine.%20I've%20got%20a%20Win10%201803%20build%20and%20a%20Windows%207%20build%20with%20the%20workplace%20join%20components%20installed%20I've%20got%20the%20SCP%20in%20on-prem%20AD%20which%20was%20created%20by%20AD%20Connect.%20To%20coin%20a%20phrase%20'why%20is%20it%20working%2C%20what%20am%20I%20doing%20wrong%3F!'%20Any%20insights%20would%20be%20much%20appreciated.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ECheers%2C%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3ERhys%20Goodwin%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-869321%22%20slang%3D%22en-US%22%3ERe%3A%20The%20Mysterious%20Case%20of%20the%20%24%20(a.k.a.%20Dollar%20Sign)%20Character%20in%20Hybrid%20Azure%20AD%20Joined%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-869321%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EThanks%20for%20sharing%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CA%20href%3D%22http%3A%2F%2Fwww.sabt-mollasadra.com%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ewww.sabt-mollasadra.com%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CA%20href%3D%22http%3A%2F%2Fwww.sabtmollasadra.com%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ewww.sabtmollasadra.com%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-870473%22%20slang%3D%22en-US%22%3ERe%3A%20The%20Mysterious%20Case%20of%20the%20%24%20(a.k.a.%20Dollar%20Sign)%20Character%20in%20Hybrid%20Azure%20AD%20Joined%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-870473%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F395767%22%20target%3D%22_blank%22%3E%40RhysGoodwin%3C%2FA%3E%26nbsp%3B%20First%20of%20all%20%2C%20apologize%20for%20the%20delayed%20response%20and%20thanks%20for%20your%20comment.%26nbsp%3B%20That%20is%20a%20very%20interesting%20scenario%20that%20I've%20never%20ran%20into%20-%20Technically%20yes%20in%20order%20to%20consider%20any%20device%20to%20be%20truly%20%22hybrid%20Joined%22%26nbsp%3B%20it%20has%20to%20be%20synced%20%2C%20this%20way%20Azure%20device%20registration%20service%26nbsp%3B%20does%20its%20magic%20too.%26nbsp%3B%20%26nbsp%3BIt%20is%20interesting%20that%20you%20are%20even%20seeing%20CA's%20applying%20properly%20%2C%26nbsp%3B%20I'm%20curious%2C%20when%20you%20run%20dsregcmd%20%2Fstatus%20on%20one%20of%20these%20not-synced%20devices%20%2C%20to%20you%20see%20a%20proper%20PRT%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-908367%22%20slang%3D%22en-US%22%3ERe%3A%20The%20Mysterious%20Case%20of%20the%20%24%20(a.k.a.%20Dollar%20Sign)%20Character%20in%20Hybrid%20Azure%20AD%20Joined%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-908367%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Jorge%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20ae%20seeing%20this%20when%20devices%20go%20from%20Azure%20AD%20registered%20to%20Hybrid%20Joined.%20We%20rolled%20out%20Hybrid%20Join%20via%20GP%20and%20AD%20Connect%20after%20devices%20were%20registered%2C%20and%20when%20this%20happened%2C%20there%20was%202%20entries%20in%20AAD%20for%20the%20devices%2C%20one%20registered%2C%20one%20hybrid.%20The%20hybrid%20one%20would%20have%20the%20%24%20sign.%20Sometimes%20just%20waiting%20allows%20the%20Hybrid%20PC%20to%20get%20into%20Intune%20and%20compliant%2C%20but%20sometimes%20it%20doesn't.%20Any%20ideas%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3EGary%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-768326%22%20slang%3D%22en-US%22%3EThe%20Mysterious%20Case%20of%20the%20%24%20(a.k.a.%20Dollar%20Sign)%20Character%20in%20Hybrid%20Azure%20AD%20Joined%20Devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-768326%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Everyone%2C%20Jorge%20Lopez%20here.%26nbsp%3B%20I%E2%80%99m%20a%20Hybrid%20Identity%20Premier%20Field%20Engineer%20at%20Microsoft.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3EF%3CSPAN%20style%3D%22text-align%3A%20left%3B%20color%3A%20%23333333%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20inherit%3B%20font-size%3A%2016px%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20text-decoration%3A%20none%3B%20word-spacing%3A%200px%3B%20display%3A%20inline%20!important%3B%20white-space%3A%20normal%3B%20cursor%3A%20text%3B%20orphans%3A%202%3B%20float%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20background-color%3A%20%23ffffff%3B%22%3Eollow%20me%20on%20Twitter%20at%20%3A%20%3CA%20href%3D%22https%3A%2F%2Ftwitter.com%2FJorgeALopez%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%40JorgeALopez%3C%2FA%3E%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20style%3D%22text-align%3A%20left%3B%20color%3A%20%23333333%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20inherit%3B%20font-size%3A%2016px%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20text-decoration%3A%20none%3B%20word-spacing%3A%200px%3B%20display%3A%20inline%20!important%3B%20white-space%3A%20normal%3B%20cursor%3A%20text%3B%20orphans%3A%202%3B%20float%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EToday%20I%E2%80%99ll%20be%20sharing%20with%20you%20an%20interesting%20scenario%20with%20a%20customer%20and%20their%20hybrid%20Azure%20AD%20joined%20devices.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20this%20scenario%20%2C%20I%20won%E2%80%99t%20go%20into%20the%20details%20on%20how%20Hybrid%20Azure%20AD%20Join%20works%2C%20so%20If%20you%20are%20not%20familiar%20with%20the%20concept%2C%20%26nbsp%3Bstop%20for%20a%20second%20and%20read%20this%20documentation%20%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Fhybrid-azuread-join-plan%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevices%2Fhybrid-azuread-join-plan%3C%2FA%3E.%20%26nbsp%3BThis%20scenario%20does%20not%20apply%20for%20Azure%20AD%20registered%20or%20%E2%80%9Cpure%E2%80%9D%20Azure%20AD%20Joined%20devices.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOne%20morning%2C%20I%20was%20still%20on%20my%20second%20sip%20of%20coffee%20when%20I%20was%20contacted%20by%20a%20customer%20regarding%20the%20appearance%20of%20a%20dollar%20sign%20character%20at%20the%20end%20of%20the%20names%20on%20Hybrid-Joined%20Azure%20AD%20Devices.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20the%20beginning%20it%20didn%E2%80%99t%20feel%20like%20a%20big%20deal%20since%20as%20you%20may%20know%20Hybrid%20Joined%20Devices%20in%20Azure%20AD%20are%20synced%20or%20%E2%80%9Cjoined%E2%80%9D%20using%20a%20common%20Source%20Anchor%20%2C%20this%20anchor%20attribute%20is%20usually%20ObjectGUID%20in%20AD%20-%26gt%3B%20DeviceID%20in%20AAD%2C%20this%20means%20that%20%26nbsp%3Bno%20matter%20how%20many%20changes%20you%20make%20to%20the%20rest%20of%20the%20attributes%20of%20the%20object%20these%20are%20bound%20or%20joined%20through%20this%20anchor%20that%20will%20never%20change%20during%20the%20lifetime%20of%20the%20object%20(or%20that%E2%80%99s%20the%20idea)%20%26nbsp%3B%2C%20so%20even%20if%20the%20display%20name%20is%20different%20%2C%26nbsp%3B%20in%20the%20backend%20Azure%20AD%20knows%20it%E2%80%99s%20the%20same%20object%2C%20so%20there%20wasn%E2%80%99t%20really%20an%20issue%20here.%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20issue%20for%20this%20customer%20is%20that%20they%20were%20doing%20some%20custom%20scripting%20to%20generate%20reports%20about%20Bitlocker%20encryption%20status%20from%20all%20their%20Windows%2010%20devices%20in%20Azure%2C%20for%20this%20to%20be%20accurate%2C%20both%20on-prem%20and%20Azure%20AD%20display%20names%20would%20be%20needed%20to%20have%20an%20exact%20match.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETheir%20results%20were%20inconsistent%20%2C%20since%20for%20a%20period%20of%20time%20it%20was%20not%20able%20to%20find%20a%20matching%20computer%20in%20Azure%20AD%20with%20the%20same%20name%20of%20the%20On-prem%20AD%20this%20is%20because%20%E2%80%A6%20yes%20you%20guessed%20it%20%E2%80%A6%20in%20Azure%20AD%20the%20object%20display%20name%20had%20a%20trailing%20%E2%80%9C%24%E2%80%9D%20at%20the%20end%20while%20the%20on-prem%20computer%20object%20did%20not.%20%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20first%20thought%20about%20modifying%20the%20script%20to%20use%20a%20different%20attribute%20or%20even%20add%20some%20logic%20to%20the%20script%20to%20validate%20both%20with%20or%20without%20the%20%E2%80%9C%24%E2%80%9D%20but%20hey!%20that%20would%20have%20been%20too%20easy%20right%3F%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20this%20point%20I%20was%20intrigued%20and%20decided%20to%20dig%20deeper%20into%20this%20and%20try%20to%20find%20exactly%20what%20was%20going%20on.%20There%20was%20one%20important%20thing%20to%20consider%2C%20this%20appeared%20to%20be%20only%20happening%20to%20computers%20that%20had%20been%20previously%20renamed%20in%20Active%20Directory%20(On-prem).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20first%20step%20was%20to%20try%20to%20replicate%20the%20issue%2C%20so%20we%20took%20an%20existing%20machine%20named%20%3CSTRONG%3EPFEWIN10.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EComputer%20Name%20in%20OS%20Settings%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20354px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124087iB9016F949D80D97F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image001.png%22%20title%3D%22image001.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDisplay%20Name%20in%20Azure%20AD%20Devices%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20579px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124088iC6D4088C50D1DCFA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image002.png%22%20title%3D%22image002.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ESo%20far%20so%20good%20%E2%80%93%20names%20match%2C%20then%20we%20renamed%20it%20through%20the%20system%20properties%20within%20the%20Operating%20System%20from%20%3CSTRONG%3EPFEWIN10%3C%2FSTRONG%3Eto%20%3CSTRONG%3ENEW-PFEWIN10%2C%20%3C%2FSTRONG%3Ewaited%20for%20the%20next%20sync%20cycle%20and%20there%20it%20was%2C%20in%20Azure%20AD%20the%20computer%E2%80%99s%20display%20name%20was%3A%20%26nbsp%3B%3CSTRONG%3ENEW-PFEWIN10%24%20%3C%2FSTRONG%3Ewhile%20in%20the%20Computer%20Name%20in%20the%20OS%20settings%20was%20without%20the%20%E2%80%9C%24%E2%80%9D%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EComputer%20Name%20in%20OS%20Settings%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20363px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124107i5A777B1FA5C1FBB1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image003.png%22%20title%3D%22image003.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EDisplay%20Name%20in%20Azure%20AD%20Devices%20list%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20587px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124090i8FCD7C99E5FCD370%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image004.png%22%20title%3D%22image004.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EAzure%20AD%20Connect%20was%20telling%20us%20about%20the%20update%20in%20its%20log%20as%20well%20as%20the%20%3CSTRONG%3Eaudit%20log%3C%2FSTRONG%3Ein%20for%20the%20device%20in%20the%20azure%20portal%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20675px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124091i4771192D98AEBE0E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image005.png%22%20title%3D%22image005.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ESo%2C%20it%20shows%20the%20computer%20was%20renamed%20but%20what%20is%20up%20with%20that%20%E2%80%9C%24%E2%80%9D%20character%20at%20the%20end%20of%20it%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20a%20couple%20of%20hours%20(and%20sometimes%20more)%2C%20this%20was%20being%20%E2%80%98fixed%E2%80%99%20by%20itself.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20556px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124092i64BAD896E1B647A2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image006.png%22%20title%3D%22image006.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWe%20noticed%20the%20following%20logs%20in%20Azure%20AD%20once%20the%20display%20name%20was%20showing%20the%20correct%20value%20without%20the%20%24%20character%20and%20the%20Device%20Audit%20logs%20was%20showing%20us%20the%20change%2C%20notice%20the%20%E2%80%9CInitiated%20by%E2%80%9D%20Column%3C%2FP%3E%0A%3CP%3E%3CEM%3E%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20675px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124093iC27FDE0EF582A67F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image007.png%22%20title%3D%22image007.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3EAHA!%20%E2%80%93%20So%2C%20the%20Device%20registration%20service%20is%20now%20renaming%20this%20back%20to%20the%20actual%20name%20in%20AD%20without%20the%20%E2%80%9C%24%E2%80%9D%2C%20the%20question%20is%20why%20AAD%20connect%20was%20adding%20it%20in%20the%20first%20place%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETime%20to%20go%20to%20the%20Azure%20AD%20Connect%20Rules%20for%20Device%20Synchronization%20and%20look%20at%20the%20Devices%20Rule.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20found%20that%20there%20is%20an%20Inbound%20Rule%20%3CSTRONG%3E(In%20from%20AD)%3C%2FSTRONG%3Ethat%20is%20calculating%20the%20value%20of%20the%20%3CSTRONG%3Edisplayname%26nbsp%3B%3C%2FSTRONG%3ETarget%20attribute%20to%20Azure%20AD.%20This%20rule%20is%20called%3A%26nbsp%3B%20%3CSTRONG%3EIn%20from%20AD%20-%20Computer%20Join%20and%26nbsp%3B%3C%2FSTRONG%3EIt%20has%20the%20following%20provisioning%20expression%20for%20the%20%3CSTRONG%3Edisplayname%3C%2FSTRONG%3Erule%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EIIF(IsNullOrEmpty(%5BdisplayName%5D)%2C%5Bcn%5D%2C%5BdisplayName%5D)%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20English%2C%20the%20above%20rules%20provision%20the%20device%20displayname%20attribute%20in%20Azure%20AD%20to%20match%20the%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3Eattribute%20on-prem%2C%20BUT%20if%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3Eis%20empty%20then%20use%20the%20%3CSTRONG%3E%3CEM%3ECN%3C%2FEM%3E%3C%2FSTRONG%3Eattribute%20from%20the%20computer%20object%20On-prem.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20explains%20it%20now%20%E2%80%93%20So%20when%20a%20computer%20is%20first%20joined%20to%20the%20domain%20%2C%20the%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3Eattribute%20in%20AD%20is%20usually%20%3CSTRONG%3E%3CNOT%20set%3D%22%22%3E%3C%2FNOT%3E%3C%2FSTRONG%3E%26nbsp%3B%2C%20hence%20in%20Azure%20AD%20%2C%20the%20device%E2%80%99s%20display%20name%20is%20populated%20with%20the%20value%20of%20the%20%3CSTRONG%3ECN%3C%2FSTRONG%3Eattribute%20(as%20the%20rules%20mandates)%2C%20this%20will%20not%20change%20until%20the%20actual%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3Eon-premises%20is%20populated%20on%20certain%20events..%20like%20renaming%20a%20computer.%20%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20Active%20Directory%20Domain%20Services%20when%20a%20computer%20is%20renamed%2C%26nbsp%3B%20the%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3E%26nbsp%3Battribute%20is%20then%20populated%20with%20the%20name%20of%20the%20computer%20and%20appends%20a%20%24%20to%20the%20end%20(this%20is%20on-prem%20AD%20by%20design)%2C%20since%20now%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3Eattribute%20is%20not%20NULL%20%2C%20AAD%20connect%20uses%20%3CSTRONG%3E%3CEM%3Edisplayname%3C%2FEM%3E%3C%2FSTRONG%3Eon-prem%20instead%20of%20%3CSTRONG%3ECN%20%3C%2FSTRONG%3E%26nbsp%3Bto%20populate%20the%20display%20name%20value%20in%20the%20AAD%20object%E2%80%A6%20still%20with%20me%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20rule%20logic%20is%20basically%20the%20culprit%20of%20having%20%24%20in%20the%20end%20of%20all%20devices%20%3CU%3Ethat%20have%20been%20renamed.%3C%2FU%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20is%20great%20but%20now%3A%20%26nbsp%3Bhow%20are%20these%20getting%20renamed%20back%20by%20Device%20Registration%20Service%20(DRS)%3F%20The%20answer%20is%20simple%20%2C%20DRS%20does%20NOT%20uses%20%3CSTRONG%3E%3CEM%3Edisplaymame%3C%2FEM%3E%3C%2FSTRONG%3E%26nbsp%3B%20or%20%3CSTRONG%3E%3CEM%3ECN%3C%2FEM%3E%3C%2FSTRONG%3E%26nbsp%3B%20to%20populate%20the%20Display%20Name%20in%20Azure%20AD%2C%20DRS%20uses%20another%20attribute%20called%3A%20%3CSTRONG%3E%3CEM%3EdNSHostName%3C%2FEM%3E%3C%2FSTRONG%3Ea.k.a.%20the%20FQDN%20of%20the%20computer%2C%26nbsp%3B%20DRS%20uses%20a%20function%20to%20only%20take%20a%20portion%20of%20this%20attribute%20%2C%20from%20the%20first%20dot%20to%20the%20left.%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ei.e.%3A%26nbsp%3B%20%3CSTRONG%3Eabc123.contoso.com%20%3C%2FSTRONG%3Ewill%20be%20populated%20as%20%3CSTRONG%3Eabc123%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1793509499%22%20id%3D%22toc-hId-1793509499%22%3E%3CSTRONG%3ESolution%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EVery%20Cool%2C%20so%20how%20do%20we%20fix%20it%20using%20AAD%20Connect%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20first%20thought%20was%20to%20remove%20the%20%E2%80%9CIF%E2%80%9D%20condition%20in%20the%20rule%2C%20so%20AAD%20connect%20will%20never%20use%20%3CSTRONG%3E%3CEM%3EdisplayName%3C%2FEM%3E%3C%2FSTRONG%3Eas%20the%20attribute%20to%20project%2C%20instead%20always%20use%20%3CSTRONG%3E%3CEM%3ECN%3C%2FEM%3E%3C%2FSTRONG%3E(Direct%20Flow%20type%20instead%20of%20Expression).%20That%20would%20work%20for%20most%20organizations%2C%20except%20for%20those%20that%20have%20computer%20names%20larger%20than%2015%20characters%20since%20%3CSTRONG%3E%3CEM%3ECN%3C%2FEM%3E%3C%2FSTRONG%3Eis%20basically%20the%20short%20name%20(NETBIOS)%20of%20the%20computer%20causing%20the%20display%20name%20in%20Azure%20to%20be%20truncated.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20consistency%2C%20I%20suggested%20to%20create%20a%20custom%20rule%20that%20will%20be%20using%20the%20same%20logic%20to%20project%20the%20display%20name%20attribute%20in%20Azure%20AD%2C%20which%20is%20using%20the%20%E2%80%9Cleft%E2%80%9D%20side%20of%20%26nbsp%3B%3CSTRONG%3E%3CEM%3EdNSHostName%3C%2FEM%3E%3C%2FSTRONG%3E%2C%20Fortunately%2C%20Azure%20AD%20Connect%20Sync%20Rules%20Editor%20support%20some%20text%20manipulation%20functions%20too!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20accomplish%20this%2C%20a%20new%20custom%20Sync%20Rule%20in%20Azure%20AD%20Connect%20that%20overrides%20the%20default%20%3CSTRONG%3EdisplayName%3C%2FSTRONG%3Eattribute%20must%20be%20created.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHere%E2%80%99s%20the%20function%20that%20would%20do%20the%20trick%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EUCase(Left(%5BdNSHostName%5D%2CInStr(%5BdNSHostName%5D%2C%22.%22)%20-%201))%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EFunction%20Explanation%3C%2FSTRONG%3E%3A%20%E2%80%9CFind%20the%20position%20of%20the%20first%20dot%20on%20%3CSTRONG%3EdNSHostName%3C%2FSTRONG%3Eattribute%2C%20then%20take%20the%20left%20portion%20of%20this%20same%20attribute%20starting%20on%20that%20position%20minus%201%20and%20change%20it%20to%20upper%20case.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E*The%20UCase%20function%20(to%20uppercase)%20is%20for%20consistency%20only%2C%20not%20required.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--955160967%22%20id%3D%22toc-hId--955160967%22%3E%3CFONT%20size%3D%225%22%3EHere%20are%20some%20step%20by%20step%20instructions%20on%20how%20to%20create%20this%20rule%3C%2FFONT%3E%3C%2FH3%3E%0A%3CH2%20id%3D%22toc-hId-984162873%22%20id%3D%22toc-hId-984162873%22%3E%26nbsp%3B%3C%2FH2%3E%0A%3CH2%20id%3D%22toc-hId--1567994088%22%20id%3D%22toc-hId--1567994088%22%3E%3CFONT%20size%3D%223%22%3ESTEP%201)%20Make%20sure%20the%20dNSHostName%20attribute%20is%20being%20synced%20to%20Azure%20AD%20from%20On-prem%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3ENOTE%3A%20This%20attribute%20is%20not%20in%20the%20list%20of%20the%20%E2%80%9CDirectory%20Extensions%E2%80%9D%20configuration%20through%20the%20AAD%20Connect%20console%2C%20hence%20this%20must%20be%20added%20directly%20on%20the%20connector%20in%20the%20Synchronization%20Service%20Console.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1.%20On%20your%20Azure%20AD%20Connect%20Server%2C%20Open%20%3CSTRONG%3ESynchronization%20Service%20%E2%80%93%20Connectors%20Tab%20%E2%80%93%20%3C%2FSTRONG%3Eand%20Select%20the%20connector%20type%3CSTRONG%3EActive%20Directory%20Domain%20Services.%20%3C%2FSTRONG%3EClick%20on%3CSTRONG%3EProperties%3C%2FSTRONG%3E(This%20should%20be%20the%20connect%20for%20you%20on-prem%20domain).%3CSTRONG%20style%3D%22font-family%3A%20inherit%3B%22%3E%26nbsp%3B%3C%2FSTRONG%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20599px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124095iEBD3807C0D843D97%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image008.png%22%20title%3D%22image008.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E2.%20On%20the%20properties%20Screen%2C%20in%20the%20connector%20Designer%20section%20Click%20on%20%3CSTRONG%3ESelect%20Attributes%20%3C%2FSTRONG%3E%26nbsp%3Band%20make%20sure%20the%20%3CSTRONG%3EdNSHostName%20%3C%2FSTRONG%3Eattribute%20is%20checked%2C%20if%20it%E2%80%99s%20not%2C%20then%20click%20on%20%3CSTRONG%3EShow%20All%3C%2FSTRONG%3Echeckbox%20at%20the%20top%20right%20%E2%80%93%20find%20the%20attribute%2C%20select%20it%20and%20click%20%3CSTRONG%3EOK.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20350px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124096i5A3AE1BF1DF116A0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image009.png%22%20title%3D%22image009.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-174816247%22%20id%3D%22toc-hId-174816247%22%3E%3CFONT%20size%3D%223%22%3ESTEP%202)%20Create%20a%20Custom%20rule%20in%20AAD%20Connect%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3E1.%20Create%20a%20New%20Rule%20with%20Higher%20precedence%20(Lower%20Number)%20in%20Azure%20AD%20connect%20Rules%20Editor%20that%20contains%20the%20function%20mentioned%20above.%20%26nbsp%3BMake%20sure%20the%20scheduler%20is%20disabled%2C%20this%20is%20to%20prevent%20the%20sync%20to%20run%20while%20changes%20are%20being%20made%20and%20to%20troubleshoot%20new%20rules%20before%20exporting%20any%20changes%20to%20Azure%20AD.%20To%20temporarily%20disable%20the%20scheduler%2C%20start%20PowerShell%20and%20run%20%3CSTRONG%3ESet-ADSyncScheduler%20-SyncCycleEnabled%20%24false%3C%2FSTRONG%3E.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20431px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124097i9C93D62A57AC787E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image010.png%22%20title%3D%22image010.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E2.%20On%20your%20Azure%20AD%20Connect%20Server%20-%20Open%20AAD%20Connect%20%3CSTRONG%3ESynchronization%20Rules%20Editor%20and%20%3C%2FSTRONG%3EClick%20on%20%E2%80%9C%3CSTRONG%3EAdd%20new%20rule%E2%80%9D%3C%2FSTRONG%3E%2C%20make%20sure%20the%20Direction%20is%20set%20to%20%E2%80%9C%3CSTRONG%3EInbound%E2%80%9D%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20136px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124104iEA6D1326BBE22FFB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image011.png%22%20title%3D%22image011.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20610px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124105iBE96FF1514BCFEFC%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image012.png%22%20title%3D%22image012.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3.%20On%20the%20%3CSTRONG%3EDescription%3C%2FSTRONG%3Epage%2C%20enter%20the%20following%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20675px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124100i7A5BD6DB029636B7%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image013.png%22%20title%3D%22image013.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EName%3A%20%3C%2FSTRONG%3EGive%20the%20rule%20a%20descriptive%20name%2C%20try%20to%20keep%20the%20default%20naming%20convention%20if%20possible.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EDescription%3C%2FSTRONG%3E%3A%20Give%20some%20clarification%20so%20someone%20else%20can%20understand%20what%20the%20rule%20is%20for.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EConnected%20System%20%3C%2FSTRONG%3Eshould%20be%20your%20on-prem%20AD%20domain%20name%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EConnected%20System%20Object%20Type%20%3C%2FSTRONG%3Eshould%20be%20set%20to%20%3CSTRONG%3EComputer%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3ESet%20%3CSTRONG%3EMetaverse%20Object%20Type%20%3C%2FSTRONG%3Eto%20%3CSTRONG%3Edevice%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3ELink%20type%3C%2FSTRONG%3E%3A%20Make%20sure%20you%20choose%20%3CSTRONG%3E%3CU%3EJoin%3C%2FU%3E%3C%2FSTRONG%3E(In%20that%20way%2C%20this%20rule%20only%20overrides%20the%20attribute%20once%20the%20objects%20are%20already%20provisioned%20by%20the%20default%20rule)%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EPrecedence%3A%20%3C%2FSTRONG%3EProvide%20a%20value%20that%20is%20unique%20in%20the%20system.%20A%20lower%20numeric%20value%20indicates%20higher%20precedence.%3C%2FLI%3E%0A%3CLI%3ELeave%20%3CSTRONG%3ETag%20%3C%2FSTRONG%3Eempty%20and%20make%20sure%20the%20%3CSTRONG%3EEnable%20Password%20Sync%20%3C%2FSTRONG%3Eand%20%3CSTRONG%3EDisabled%20%3C%2FSTRONG%3Eoptions%20are%20unchecked%3C%2FLI%3E%0A%3CLI%3EClick%20Next%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E4.%20On%20the%20%3CSTRONG%3EScoping%20Filter%3C%2FSTRONG%3Escreen%2C%20leave%20this%20empty%20and%20click%20%3CSTRONG%3ENext%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E5.%20On%20the%20%3CSTRONG%3EJoin%20Rules%3C%2FSTRONG%3Epage%2C%20Leave%20the%20field%20empty%20and%20click%20%3CSTRONG%3ENext%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E6.%20On%20the%20%3CSTRONG%3ETransformations%20%3C%2FSTRONG%3Epage%2C%20Click%20%3CSTRONG%3EAdd%20transformation%3C%2FSTRONG%3E%2C%20then%20choose%20the%20following%20options%3A%20%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20675px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124101i0432AC857579B575%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image014.png%22%20title%3D%22image014.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EChoose%20%3CSTRONG%3EExpression%20%3C%2FSTRONG%3Eas%20the%20%3CSTRONG%3EFlow%20Type%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3ESelect%20%3CSTRONG%3EdisplayName%20%3C%2FSTRONG%3Eas%20the%20%3CSTRONG%3ETarget%20Attribute%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3Ein%20the%20%3CSTRONG%3ESource%20%3C%2FSTRONG%3Efield%20Type%20the%20Expression%3A%20%3CSTRONG%3EUCase(Left(%5BdNSHostName%5D%2CInStr(%5BdNSHostName%5D%2C%22.%22)%20-%201))%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EWarning%3C%2FSTRONG%3E%3A%20Please%20do%20not%20copy-paste%20the%20above%20function%20since%20some%20characters%20like%20double%20quotes%20and%20commas%20from%20the%20web%20page%20formatting%20may%20not%20be%20the%20same%20that%20are%20needed%20in%20AAD%20connect%20functions%20(character-wise)%20and%20may%20cause%20sync%20errors.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EApply%20Once%3C%2FSTRONG%3Eshould%20be%20unchecked%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EMerge%20Type%3C%2FSTRONG%3Eshould%20set%20as%20%3CSTRONG%3EUpdate%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3CLI%3EClick%20%3CSTRONG%3EAdd%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E7.%20The%20scheduler%20can%20now%20be%20enabled%20again%2C%20From%20PowerShell%2C%20run%20%3CSTRONG%3ESet-ADSyncScheduler%20-SyncCycleEnabled%20%24true.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20426px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124102i98CFD51DA6C85E9E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image015.png%22%20title%3D%22image015.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1917626582%22%20id%3D%22toc-hId-1917626582%22%3E%3CFONT%20size%3D%223%22%3ESTEP%203)%20Run%20a%20Full%20Sync%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%3ERunning%20a%20Full%20Sync%20is%20needed%20after%20any%20Rule%20change%20in%20AAD%20Connect%2C%20otherwise%20this%20change%20won%E2%80%99t%20take%20any%20effect.%3C%2FP%3E%0A%3CP%3EOn%20the%20Azure%20AD%20Connect%20Server%2C%20Open%20a%20PowerShell%20Window%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EType%20%3CSTRONG%3EStart-ADSyncSyncCycle%20-PolicyType%20Initial%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20410px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124103i67F0D53405515092%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22image016.png%22%20title%3D%22image016.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EWarning%3C%2FSTRONG%3E%3A%20This%20will%20take%20from%20a%20few%20minutes%20to%20several%20hours%20depending%20on%20the%20size%20of%20your%20organization.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat%E2%80%99s%20it!%26nbsp%3B%20Now%20all%20the%20Hybrid%20Azure%20AD%20Joined%20Devices%E2%80%99%20display%20names%20in%20Azure%20AD%20will%20always%20match%20on-prem%20Computer%20Names%20all%20the%20time%2C%20%26nbsp%3Bthose%20devices%20that%20already%20have%20the%20proper%20name%20will%20not%20be%20changed%20but%20all%20new%20computers%20that%20will%20be%20synced%20for%20the%20first%20time%20will%20now%20use%20the%20same%20provisioning%20logic%20to%20populate%20its%20display%20name.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20followed%20along%2C%20hope%20you%20enjoyed!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-768326%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Everyone%2C%20Jorge%20Lopez%20here.%26nbsp%3B%20I%E2%80%99m%20a%20Hybrid%20Identity%20Premier%20Field%20Engineer%20at%20Microsoft.%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EToday%20I%E2%80%99ll%20be%20sharing%20with%20you%20an%20interesting%20scenario%20with%20a%20customer%20and%20their%20hybrid%20Azure%20AD%20joined%20devices.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F124109iAD66AAF463FADB2A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22aaddeviceauditlog.jpg%22%20title%3D%22aaddeviceauditlog.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-768326%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EJorgeLopez%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

Hi Everyone, Jorge Lopez here.  I’m a Hybrid Identity Premier Field Engineer at Microsoft.

 

Follow me on Twitter at : @JorgeALopez  

 

Today I’ll be sharing with you an interesting scenario with a customer and their hybrid Azure AD joined devices.

 

For this scenario , I won’t go into the details on how Hybrid Azure AD Join works, so If you are not familiar with the concept,  stop for a second and read this documentation : https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan.  This scenario does not apply for Azure AD registered or “pure” Azure AD Joined devices.

 

One morning, I was still on my second sip of coffee when I was contacted by a customer regarding the appearance of a dollar sign character at the end of the names on Hybrid-Joined Azure AD Devices.

 

At the beginning it didn’t feel like a big deal since as you may know Hybrid Joined Devices in Azure AD are synced or “joined” using a common Source Anchor , this anchor attribute is usually ObjectGUID in AD -> DeviceID in AAD, this means that  no matter how many changes you make to the rest of the attributes of the object these are bound or joined through this anchor that will never change during the lifetime of the object (or that’s the idea)  , so even if the display name is different ,  in the backend Azure AD knows it’s the same object, so there wasn’t really an issue here.  

 

The issue for this customer is that they were doing some custom scripting to generate reports about Bitlocker encryption status from all their Windows 10 devices in Azure, for this to be accurate, both on-prem and Azure AD display names would be needed to have an exact match.

 

Their results were inconsistent , since for a period of time it was not able to find a matching computer in Azure AD with the same name of the On-prem AD this is because … yes you guessed it … in Azure AD the object display name had a trailing “$” at the end while the on-prem computer object did not.   

 

We first thought about modifying the script to use a different attribute or even add some logic to the script to validate both with or without the “$” but hey! that would have been too easy right?  

 

At this point I was intrigued and decided to dig deeper into this and try to find exactly what was going on. There was one important thing to consider, this appeared to be only happening to computers that had been previously renamed in Active Directory (On-prem).

 

The first step was to try to replicate the issue, so we took an existing machine named PFEWIN10.

 

Computer Name in OS Settings:

image001.png

 

Display Name in Azure AD Devices:

image002.png

So far so good – names match, then we renamed it through the system properties within the Operating System from PFEWIN10 to NEW-PFEWIN10, waited for the next sync cycle and there it was, in Azure AD the computer’s display name was:  NEW-PFEWIN10$ while in the Computer Name in the OS settings was without the “$”

 

Computer Name in OS Settings:

image003.png

Display Name in Azure AD Devices list: 

image004.png

Azure AD Connect was telling us about the update in its log as well as the audit log in for the device in the azure portal:

image005.png

So, it shows the computer was renamed but what is up with that “$” character at the end of it?

 

After a couple of hours (and sometimes more), this was being ‘fixed’ by itself.

image006.png

We noticed the following logs in Azure AD once the display name was showing the correct value without the $ character and the Device Audit logs was showing us the change, notice the “Initiated by” Column

 

 image007.png

 

AHA! – So, the Device registration service is now renaming this back to the actual name in AD without the “$”, the question is why AAD connect was adding it in the first place?

 

Time to go to the Azure AD Connect Rules for Device Synchronization and look at the Devices Rule.

 

We found that there is an Inbound Rule (In from AD) that is calculating the value of the displayname Target attribute to Azure AD. This rule is called:  In from AD - Computer Join and It has the following provisioning expression for the displayname rule: 

 

IIF(IsNullOrEmpty([displayName]),[cn],[displayName])

 

In English, the above rules provision the device displayname attribute in Azure AD to match the displayname attribute on-prem, BUT if displayname is empty then use the CN attribute from the computer object On-prem.

 

This explains it now – So when a computer is first joined to the domain , the displayname attribute in AD is usually <Not Set>  , hence in Azure AD , the device’s display name is populated with the value of the CN attribute (as the rules mandates), this will not change until the actual displayname on-premises is populated on certain events.. like renaming a computer.   

 

In Active Directory Domain Services when a computer is renamed,  the displayname  attribute is then populated with the name of the computer and appends a $ to the end (this is on-prem AD by design), since now displayname attribute is not NULL , AAD connect uses displayname on-prem instead of CN  to populate the display name value in the AAD object… still with me?

 

This rule logic is basically the culprit of having $ in the end of all devices that have been renamed.

 

This is great but now:  how are these getting renamed back by Device Registration Service (DRS)? The answer is simple , DRS does NOT uses displaymame  or CN  to populate the Display Name in Azure AD, DRS uses another attribute called: dNSHostName a.k.a. the FQDN of the computer,  DRS uses a function to only take a portion of this attribute , from the first dot to the left.  

 

i.e.:  abc123.contoso.com will be populated as abc123

 

Solution

 

Very Cool, so how do we fix it using AAD Connect?

 

The first thought was to remove the “IF” condition in the rule, so AAD connect will never use displayName as the attribute to project, instead always use CN (Direct Flow type instead of Expression). That would work for most organizations, except for those that have computer names larger than 15 characters since CN is basically the short name (NETBIOS) of the computer causing the display name in Azure to be truncated. 

 

For consistency, I suggested to create a custom rule that will be using the same logic to project the display name attribute in Azure AD, which is using the “left” side of  dNSHostName, Fortunately, Azure AD Connect Sync Rules Editor support some text manipulation functions too!

 

To accomplish this, a new custom Sync Rule in Azure AD Connect that overrides the default displayName attribute must be created.

 

Here’s the function that would do the trick:

 

UCase(Left([dNSHostName],InStr([dNSHostName],".") - 1))

 

Function Explanation: “Find the position of the first dot on dNSHostName attribute, then take the left portion of this same attribute starting on that position minus 1 and change it to upper case.

 

*The UCase function (to uppercase) is for consistency only, not required.

 

Here are some step by step instructions on how to create this rule

 

STEP 1) Make sure the dNSHostName attribute is being synced to Azure AD from On-prem

NOTE: This attribute is not in the list of the “Directory Extensions” configuration through the AAD Connect console, hence this must be added directly on the connector in the Synchronization Service Console.

 

1. On your Azure AD Connect Server, Open Synchronization Service – Connectors Tab – and Select the connector type Active Directory Domain Services. Click on Properties (This should be the connect for you on-prem domain).  

 

image008.png

2. On the properties Screen, in the connector Designer section Click on Select Attributes  and make sure the dNSHostName attribute is checked, if it’s not, then click on Show All checkbox at the top right – find the attribute, select it and click OK.

image009.png

STEP 2) Create a Custom rule in AAD Connect

1. Create a New Rule with Higher precedence (Lower Number) in Azure AD connect Rules Editor that contains the function mentioned above.  Make sure the scheduler is disabled, this is to prevent the sync to run while changes are being made and to troubleshoot new rules before exporting any changes to Azure AD. To temporarily disable the scheduler, start PowerShell and run Set-ADSyncScheduler -SyncCycleEnabled $false.image010.png

2. On your Azure AD Connect Server - Open AAD Connect Synchronization Rules Editor and Click on “Add new rule” , make sure the Direction is set to “Inbound”

image011.png

image012.png

 

3. On the Description page, enter the following:

image013.png

  • Name: Give the rule a descriptive name, try to keep the default naming convention if possible.
  • Description: Give some clarification so someone else can understand what the rule is for.
  • Connected System should be your on-prem AD domain name
  • Connected System Object Type should be set to Computer
  • Set Metaverse Object Type to device
  • Link type: Make sure you choose Join (In that way, this rule only overrides the attribute once the objects are already provisioned by the default rule)
  • Precedence: Provide a value that is unique in the system. A lower numeric value indicates higher precedence.
  • Leave Tag empty and make sure the Enable Password Sync and Disabled options are unchecked
  • Click Next

4. On the Scoping Filter screen, leave this empty and click Next

5. On the Join Rules page, Leave the field empty and click Next

6. On the Transformations page, Click Add transformation, then choose the following options: image014.png

  • Choose Expression as the Flow Type
  • Select displayName as the Target Attribute
  • in the Source field Type the Expression: UCase(Left([dNSHostName],InStr([dNSHostName],".") - 1))

Warning: Please do not copy-paste the above function since some characters like double quotes and commas from the web page formatting may not be the same that are needed in AAD connect functions (character-wise) and may cause sync errors.

 

  • Apply Once should be unchecked
  • Merge Type should set as Update
  • Click Add

7. The scheduler can now be enabled again, From PowerShell, run Set-ADSyncScheduler -SyncCycleEnabled $true.

image015.png

STEP 3) Run a Full Sync

Running a Full Sync is needed after any Rule change in AAD Connect, otherwise this change won’t take any effect.

On the Azure AD Connect Server, Open a PowerShell Window

  1. Type Start-ADSyncSyncCycle -PolicyType Initial

image016.png

Warning: This will take from a few minutes to several hours depending on the size of your organization.

 

That’s it!  Now all the Hybrid Azure AD Joined Devices’ display names in Azure AD will always match on-prem Computer Names all the time,  those devices that already have the proper name will not be changed but all new computers that will be synced for the first time will now use the same provisioning logic to populate its display name.

 

If you followed along, hope you enjoyed!

3 Comments
Senior Member

Hey Jorge, great post! Thanks for sharing. It gives a good insight into how sync rules work.

 

Slightly off-topic but related - are you able to explain why sync'ing of computer accounts into Azure AD is/is not required for Azure Hybrid join? Everywhere I read says 'yes'  it is required but in my lab I've got computers that are not sync'd but have happily hybrid joined them selves to AAD.  SSO, password, reset, use of device conditions in CA polices etc. all seem to work just fine. I've got a Win10 1803 build and a Windows 7 build with the workplace join components installed I've got the SCP in on-prem AD which was created by AD Connect. To coin a phrase 'why is it working, what am I doing wrong?!' Any insights would be much appreciated.

 

Cheers,

Rhys Goodwin

 

Microsoft

@RhysGoodwin  First of all , apologize for the delayed response and thanks for your comment.  That is a very interesting scenario that I've never ran into - Technically yes in order to consider any device to be truly "hybrid Joined"  it has to be synced , this way Azure device registration service  does its magic too.   It is interesting that you are even seeing CA's applying properly ,  I'm curious, when you run dsregcmd /status on one of these not-synced devices , to you see a proper PRT? 

Senior Member

Hi Jorge,

 

We ae seeing this when devices go from Azure AD registered to Hybrid Joined. We rolled out Hybrid Join via GP and AD Connect after devices were registered, and when this happened, there was 2 entries in AAD for the devices, one registered, one hybrid. The hybrid one would have the $ sign. Sometimes just waiting allows the Hybrid PC to get into Intune and compliant, but sometimes it doesn't. Any ideas?

 

Thanks,

Gary