Before starting this post, the team would like to thank all the contributions shared by the PowerShell community found on Reddit for their support on exploring PowerShell automation capabilities. The outpouring of suggestions and sharing of scripts was awesome and has resulted in another question asked for us as a community to address.
After reading the previous PowerShell Basics article, some from the ITPRO community have reached out inquiring how to force the sync of only passwords and not the entire contents of Active Directory. It appears the ask comes in light of troubleshooting Office 365 password sync issues. This post will focus on steps to address this via PowerShell.
$adConnector = "<insert local connector name here>"
$aadConnector = "<insert AzureAD connector name here>"
$c = Get-ADSyncConnector -Name $adConnector
$p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter "Microsoft.Synchronize.ForceFullPasswordSync", String, ConnectorGlobal, $null, $null, $null $p.Value = 1
$c = Add-ADSyncConnector -Connector $c
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $azureadConnector -Enable $false
Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $azureadConnector -Enable $true
Synchronization of legacy password hashes to Azure AD may take some time and depend on directory size in terms of number of accounts and groups. Once completed, the passwords are synchronized to the to Azure AD followed by syncing to the Azure AD DS managed domain.
Microsoft also provides a great document entitled Troubleshoot password hash synchronization with Azure AD Connect sync which details additional tactics to address possible sync issues.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.