We run in a multi tenant environment. We had one client were the AD COnnect password sync service would stop at random then we wouldn’t know till someone saw the alert in O365 or the customer let us know. In an effort to detect this issue and to fix it without the need to involve outside assistance i made:
-
Computer group in BigFix that contains all servers with Adconnect installed.
-
I created a task Auto AD Connect Password Sync Status
-This task i set to run dynamically and to re-apply when it becomes relevant again.
-This task exports the following data
- If Ad Connect is in staging Mode Exports to C:\Bes\AzureADpasswordSyncStaging.txt
- Out puts Azure Connector name to C:\Bes\AzureADpasswordSyncAzuredomain.txt
- Out Puts Local Domain Connector name to C:\Bes\AzureADpasswordSynclocaldomain.txt
- Out Puts status of password sync in azure cloud. Checks for the last occurrence of event 654 in the application event log to C:\BES\AzureADpasswordSync.txt
- I created a task Auto ADConnect password Hash sync fix
-This tasks watches the files created by the status task. then when it sees that the sync hasn’t happened in 3 hours it runs the fix.
-Then it waits 5 min
-Then it reruns the status check.
I am wondering if i have over done this or if there is a better way to do this.