AdConnect v2 Password write back with two different DC versions

[KleoNunket]

Hi, has anyone run into this situation?

I will be installing ADconnect on a domain member server running 2019.

However, I have two DC running two different versions, 2012 and 2016.

According to MS doc,

To use password writeback, your Domain Controllers must be Windows Server 2016 or later

I would like to enable password write back, but I'm not sure if it will work if one of them is running 2016 but the other 2012 ?

Cheers!

[#2]

Hi KleoNunket,

Password writeback needs 2012 r2 not 2016, new version of Azure AD Connect needs server 2016 so maybe the recommendation is based for this one.

Forest and domain level don't have to be 2016.

Hope this helps,

[#3]

Hi HarriJaakkonen,

Yes, it's based of the new Azure AD Connect.
New version of ad connect requires 2016(because it uses newer sql 2019).
However, if using the newer ad connect which is what I think the article is based off on, it says says that password write back requires 2016 DCs.

So, if i have an environment of DC running on server 2012 r2 and 2016, then password write back won't work, or it will still work ?

AD connect will be installed on a 2019 domain member server.

Thanks !

[#4 · Accepted solution]

Hi again,

It's not about the dc's, it's about the aad connect server. Dc's will write what aad connect tells them.

In this config you have to make sure that aad connect isn't a single point of failure and keep it updated.

So it will run like it should as long as aad connect is working.

Hope this answer to your question.

[#5]

I was confused by the part that says DC needs to be on 2016 server, but glad to hear it doesn't affect anything.

Staged mode looks to be the "redundancy" mode.
Thank you.