When -IncludeAdminSdHolders parameter is set, it does not apply correct permissions to admin users about entra-docs HOT 5 CLOSED

@sethicle
Thanks for your feedback! We will investigate and update as appropriate.

from entra-docs.

@sethicle Thank you for explaining the issue you are facing with syncing Domain Admins to Entra AD. It seems like the scripts and the Entra AD Connect Tool Trouble-shooter are not applying the correct permissions to the adminsdholder object, which is causing issues with syncing the admin accounts. Based on your explanation, it appears that the ACL is not applying to the AdminSDHolder object but rather to descendant objects, which is causing the permissions to not allow for write access. To resolve this issue, you manually ran sdprop via LDP and set AdminSDHolder to read and write for this object only (for read and write attributes) and applied it to the accounts. This allowed you to sync the admin accounts successfully. It is important to note that syncing Domain Admins to Entra AD is not recommended, as it can pose a security risk. However, if you must do so, it is important to ensure that the correct permissions are applied to the adminsdholder object to avoid any issues with syncing. I hope this information helps. Let me know if you have any further questions or concerns.

from entra-docs.

@sethicle
We are going to close this thread as resolved but if there are any further questions regarding the documentation, please tag me in your reply and we will be happy to continue the conversation.

from entra-docs.

It may want to be noted in documentation that this permission is to be set manually on the accounts to ensure syncing with Entra AD?

I do note that this is not recommended and iw I'll be adjusting this in the new year to not be DA users however if AdminSDHolder is selected the script should set the correct permissions since the documentation states that it should be set to Yes to update if you wish to sync DA users.

Thanks,
Seth

from entra-docs.

@sethicle
Based on the provided document, it seems that the permission needs to be set manually on the accounts to ensure syncing with Entra AD. However, it is not recommended to set the permission on DA users. If you want to sync DA users, you can set the AdminSDHolder to Yes to update the permissions. The script should set the correct permissions if you follow the instructions in the documentation. If you have any further questions or concerns, please let me know.

from entra-docs.