11 | October | 2015 | Mike Crowley's Whiteboard

Click the image!

Microsoft TechNet used to be one of the best documentation libraries in the industry. Sadly, it still is; so what’s that tell you about the industry today?

Office 365 and Azure are truly great cloud services, but the frequency of updates and new releases are a challenge for Microsoft’s own sales team to keep up with, let alone us in the field, trying to work with the stuff. As made abundantly clear by their actions (e.g. killing tech conferences, technical writer layoffs, shuttering TechNet subscriptions, and abandoning the MCM program), Microsoft doesn’t really see “the problem”.

When Microsoft shipped DirSync and then later Azure AD Sync, documentation of the associated PowerShell modules became increasingly sparse, though some cmdlets did have a help synopsis, as I discussed last year. Azure AD Connect, the current version of Office 365 and Azure Active Directory synchronization technology, has 69 cmdlets in the “ADSync” module.

Wanna take a guess at how many of these have an associated help topic? Don’t forget, this product was launched earlier this summer and is now on it’s second public release.

Zero

(Pause for effect)

So, I have listed all 69 cmdlets here, with a brief note about what I’ve found so far. Right now, most are empty, but I will fill them in as I discover their purpose and/or have more time. If you’ve got a question about one I don’t have detailed, leave a comment and I’ll try to prioritize some research for you. I haven’t checked with the Azure AD team on this, so please take my findings with a grain of salt, and hope for real support documentation to arrive soon!

NOTE: This refers to the “ADSync” module that ships with Azure AD Connect 1.0.8667.0.

Cmdlet	Add-ADSyncAADServiceAccount	My Comments
Sample Usage

Cmdlet

Add-ADSyncAttributeFlowMapping

My
Comments

Maps a source to target
attribute.

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

Add-ADSyncAttributeFlowMapping `

-SynchronizationRule $syncRule[0] `

-Source @(‘mailNickname’,‘sAMAccountName’)
`

-Destination ‘cloudFiltered’
`

-FlowType ‘Expression’
`

-ValueMergeType ‘Update’ `

-Expression ‘IIF(IsPresent([isCriticalSystemObject])
|| IsPresent([sAMAccountName]) = False || [sAMAccountName] =
“SUPPORT_388945a0” || Left([mailNickname], 14) =
“SystemMailbox{” || Left([sAMAccountName], 4) = “AAD_” ||
(Left([mailNickname], 4) = “CAS_” && (InStr([mailNickname],
“}”) > 0)) || (Left([sAMAccountName], 4) = “CAS_”
&& (InStr([sAMAccountName], “}”) > 0)) ||
Left([sAMAccountName], 5) = “MSOL_” ||
CBool(IIF(IsPresent([msExchRecipientTypeDetails]),BitAnd([msExchRecipientTypeDetails],&H21C07000)
> 0,NULL)) ||
CBool(InStr(DNComponent(CRef([dn]),1),”\\0ACNF:”)>0), True,
NULL)’ `

-OutVariable syncRule

Cmdlet	Add-ADSyncConnector	My Comments
Sample Usage

Cmdlet

Add-ADSyncConnectorAnchorConstructionSettings

My
Comments

Sample
Usage

Cmdlet

Add-ADSyncConnectorAttributeInclusion

My
Comments

Sample
Usage

Cmdlet

Add-ADSyncConnectorHierarchyProvisioningMapping

My
Comments

Sample
Usage

Cmdlet	Add-ADSyncConnectorObjectInclusion	My Comments
Sample Usage

Cmdlet	Add-ADSyncGlobalSettingsParameter	My Comments
Sample Usage

Cmdlet

Add-ADSyncJoinConditionGroup

My
Comments

Used in the construction of
sync rules.

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

Add-ADSyncJoinConditionGroup `

-SynchronizationRule $syncRule[0] `

-JoinConditions @($condition0[0]) `

-OutVariable syncRule

Cmdlet

Add-ADSyncRule

My
Comments

Export one of the rules
from the editor to see this and other

samples.

Sample
Usage

Add-ADSyncRule `

-SynchronizationRule $syncRule[0]

Cmdlet	Add-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet	Add-ADSyncRunStep	My Comments
Sample Usage

Cmdlet

Add-ADSyncScopeConditionGroup

My
Comments

Used in the construction of
sync rules.

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

Add-ADSyncScopeConditionGroup `

-SynchronizationRule $syncRule[0] `

-ScopeConditions @($condition0[0],$condition1[0],$condition2[0]) `

-OutVariable syncRule

Cmdlet	Disable-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Disable-ADSyncConnectorPartitionHierarchy	My Comments
Sample Usage

Cmdlet

Disable-ADSyncExportDeletionThreshold

My
Comments

Disables the accidental deletion safety feature.

More info here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-feature-prevent-accidental-deletes/

Sample
Usage

Disable-ADSyncExportDeletionThreshold

Cmdlet	Enable-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Enable-ADSyncConnectorPartitionHierarchy	My Comments
Sample Usage

Cmdlet	Enable-ADSyncExportDeletionThreshold	My Comments	Enables the accidental deletion safety feature. To verify, run Get-MsolDirSyncConfiguration.More info here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-feature-prevent-accidental-deletes/
Sample Usage	Enable-ADSyncExportDeletionThreshold

Cmdlet

Get-ADSyncAADPasswordResetConfiguration

My
Comments

I believe this is used to
report on password write-back.

Sample
Usage

Get-ADSyncAADPasswordResetConfiguration -Connector ‘demo1923.onmicrosoft.com – AAD’

Cmdlet	Get-ADSyncAADPasswordSyncConfiguration	My Comments	Indicates whether or not password hash sync is enabled (SYNC)
Sample Usage	Get-ADSyncAADPasswordSyncConfiguration -SourceConnector ‘laptop.lab’

Cmdlet	Get-ADSyncConnector	My Comments	Gets the management agents (connectors) used by the sync service.
Sample Usage	Get-ADSyncConnector

Cmdlet

Get-ADSyncConnectorHierarchyProvisioningDNComponent

My
Comments

Couldn’t get it to work

Sample
Usage

x =
Get-ADSyncConnector -Name
‘laptop.lab’

Get-ADSyncConnectorHierarchyProvisioningDNComponent -ShowHidden -Connector $x

Cmdlet

Get-ADSyncConnectorHierarchyProvisioningMapping

My
Comments

Couldn’t get it to work

Sample
Usage

$x =
Get-ADSyncConnector -Name
‘laptop.lab’

Get-ADSyncConnectorHierarchyProvisioningMapping -Connector $x

Cmdlet

Get-ADSyncConnectorHierarchyProvisioningObjectClass

My
Comments

Didn’t test: I presume it
lists the objects to be synced (e.g. people, contacts, etc)

Sample
Usage

Cmdlet	Get-ADSyncConnectorParameter	My Comments
Sample Usage

Cmdlet	Get-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Get-ADSyncConnectorPartitionHierarchy	My Comments
Sample Usage

Cmdlet	Get-ADSyncConnectorTypes	My Comments
Sample Usage

Cmdlet	Get-ADSyncGlobalSettings	My Comments	Displays Global Configuration Settings.
Sample Usage	(Get-ADSyncGlobalSettings).Parameters \| Where name -eq Microsoft.SynchronizationOption.AnchorAttribute

Cmdlet	Get-ADSyncGlobalSettingsParameter	My Comments
Sample Usage

Cmdlet	Get-ADSyncRule	My Comments	Lists the sync rules
Sample Usage

Cmdlet	Get-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet

Get-ADSyncSchema

My
Comments

Sample
Usage

Cmdlet	Get-ADSyncServerConfiguration	My Comments
Sample Usage

Cmdlet	New-ADSyncConnector	My Comments
Sample Usage

Cmdlet	New-ADSyncJoinCondition	My Comments
Sample Usage

Cmdlet

New-ADSyncRule

My
Comments

Export one of the rules
from the editor to see this and other samples.

Sample
Usage

New-ADSyncRule `

-Name ‘In from
AD – User Join’ `

-Identifier ‘c2db05cb-39bd-4e17-a19a-26718c692e48’
`

-Description ”
`

-Direction ‘Inbound’
`

-Precedence 100
`

-PrecedenceAfter ‘00000000-0000-0000-0000-000000000000’ `

-PrecedenceBefore ‘00000000-0000-0000-0000-000000000000’ `

-SourceObjectType ‘user’ `

-TargetObjectType ‘person’ `

-Connector ‘43617e64-d544-4426-9354-e7d7508915b1’
`

-LinkType ‘Provision’
`

-SoftDeleteExpiryInterval 0 `

-ImmutableTag ‘Microsoft.InfromADUserJoin.003’ `

-OutVariable syncRule

Cmdlet	New-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet	New-ADSyncScopeCondition	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAADPasswordResetConfiguration	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAADPasswordSyncConfiguration	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAADServiceAccount	My Comments
Sample Usage

Cmdlet	Remove-ADSyncAttributeFlowMapping	My Comments
Sample Usage

Cmdlet	Remove-ADSyncConnector	My Comments	Removes one of your Management Agents (Connectors)
Sample Usage

Cmdlet	Remove-ADSyncConnectorAnchorConstructionSettings	My Comments
Sample Usage

Cmdlet	Remove-ADSyncConnectorAttributeInclusion	My Comments
Sample Usage

Cmdlet

Remove-ADSyncConnectorHierarchyProvisioningMapping

My
Comments

Sample
Usage

Cmdlet	Remove-ADSyncConnectorObjectInclusion	My Comments
Sample Usage

Cmdlet	Remove-ADSyncGlobalSettingsParameter	My Comments
Sample Usage

Cmdlet	Remove-ADSyncJoinConditionGroup	My Comments
Sample Usage

Cmdlet	Remove-ADSyncRule	My Comments	Removes a sync rule.
Sample Usage

Cmdlet	Remove-ADSyncRunProfile	My Comments
Sample Usage

Cmdlet	Remove-ADSyncRunStep	My Comments
Sample Usage

Cmdlet	Remove-ADSyncScopeConditionGroup	My Comments
Sample Usage

Cmdlet	Search-ADSyncDirectoryObjects	My Comments
Sample Usage

Cmdlet	Set-ADSyncAADCompanyFeature	My Comments
Sample Usage

Cmdlet	Set-ADSyncAADPasswordResetConfiguration	My Comments
Sample Usage

Cmdlet	Set-ADSyncAADPasswordSyncConfiguration	My Comments	See details here: http://blogs.technet.com/b/undocumentedfeatures/archive/2015/11/18/reset-aadsync-or-aadconnect-password-hash-sync-configuration.aspx
Sample Usage	Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false

Cmdlet	Set-ADSyncAADPasswordSyncState	My Comments
Sample Usage

Cmdlet	Set-ADSyncConnectorParameter	My Comments
Sample Usage

Cmdlet	Set-ADSyncGlobalSettings	My Comments
Sample Usage

Cmdlet	Set-ADSyncSchema	My Comments
Sample Usage

Cmdlet	Set-ADSyncServerConfiguration	My Comments
Sample Usage

Cmdlet	Set-MIISADMAConfiguration	My Comments
Sample Usage

Cmdlet	Test-AdSyncUserHasPermissions	My Comments
Sample Usage

Cmdlet	Update-ADSyncConnectorPartition	My Comments
Sample Usage

Cmdlet	Update-ADSyncConnectorSchema	My Comments
Sample Usage

Cmdlet	Update-ADSyncDRSCertificates	My Comments
Sample Usage

Mike Crowley's Whiteboard

“There are no limits to what you can accomplish when you are supposed to be doing something else."

Daily Archives: October 11, 2015

Azure AD Connect PowerShell Cmdlets