|
| 1 | +--- |
| 2 | +title: Enable password hash sync for Azure AD Domain Services | Microsoft Docs |
| 3 | +description: In this tutorial, learn how to enable password hash synchronization using Azure AD Connect to an Azure Active Directory Domain Services managed domain. |
| 4 | +author: iainfoulds |
| 5 | +manager: daveba |
| 6 | + |
| 7 | +ms.service: active-directory |
| 8 | +ms.subservice: domain-services |
| 9 | +ms.workload: identity |
| 10 | +ms.topic: tutorial |
| 11 | +ms.date: 08/16/2019 |
| 12 | +ms.author: iainfou |
| 13 | + |
| 14 | +#Customer intent: As an server administrator, I want to learn how to enable password hash synchronization with Azure AD Connect to create a hybrid environment using an on-premises AD DS domain. |
| 15 | +--- |
| 16 | + |
| 17 | +# Tutorial: Enable password synchronization in Azure Active Directory Domain Services for hybrid environments |
| 18 | + |
| 19 | +For hybrid environments, an Azure Active Directory (Azure AD) tenant can be configured to synchronize with an on-premises Active Directory Domain Services (AD DS) environment using Azure AD Connect. By default, Azure AD Connect doesn't synchronize legacy NT LAN Manager (NTLM) and Kerberos password hashes that are needed for Azure Active Directory Domain Services (Azure AD DS). |
| 20 | + |
| 21 | +To use Azure AD DS with accounts synchronized from an on-premises AD DS environment, you need to configure Azure AD Connect to synchronize those password hashes required for NTLM and Kerberos authentication. After Azure AD Connect is configured, an on-premises account creation or password change event also then synchronizes the legacy password hashes to Azure AD. |
| 22 | + |
| 23 | +You don't need to perform these steps if you use cloud-only accounts with no on-premises AD DS environment. |
| 24 | + |
| 25 | +In this tutorial, you learn: |
| 26 | + |
| 27 | +> [!div class="checklist"] |
| 28 | +> * Why legacy NTLM and Kerberos password hashes are needed |
| 29 | +> * How to configure legacy password hash synchronization for Azure AD Connect |
| 30 | +
|
| 31 | +If you don’t have an Azure subscription, [create an account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin. |
| 32 | + |
| 33 | +## Prerequisites |
| 34 | + |
| 35 | +To complete this tutorial, you need the following resources: |
| 36 | + |
| 37 | +* An active Azure subscription. |
| 38 | + * If you don’t have an Azure subscription, [create an account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). |
| 39 | +* An Azure Active Directory tenant associated with your subscription that's synchronized with an on-premises directory using Azure AD Connect. |
| 40 | + * If needed, [create an Azure Active Directory tenant][create-azure-ad-tenant] or [associate an Azure subscription with your account][associate-azure-ad-tenant]. |
| 41 | + * If needed, [enable Azure AD Connect for password hash synchronization][enable-azure-ad-connect]. |
| 42 | +* An Azure Active Directory Domain Services managed domain enabled and configured in your Azure AD tenant. |
| 43 | + * If needed, [create and configure an Azure Active Directory Domain Services instance][create-azure-ad-ds-instance]. |
| 44 | + |
| 45 | +## Password hash synchronization using Azure AD Connect |
| 46 | + |
| 47 | +Azure AD Connect is used to synchronize objects like user accounts and groups from an on-premises AD DS environment into an Azure AD tenant. As part of the process, password hash synchronization enables accounts to use the same password in the on-prem AD DS environment and Azure AD. |
| 48 | + |
| 49 | +To authenticate users on the managed domain, Azure AD DS needs password hashes in a format that's suitable for NTLM and Kerberos authentication. Azure AD doesn't store password hashes in the format that's required for NTLM or Kerberos authentication until you enable Azure AD DS for your tenant. For security reasons, Azure AD also doesn't store any password credentials in clear-text form. Therefore, Azure AD can't automatically generate these NTLM or Kerberos password hashes based on users' existing credentials. |
| 50 | + |
| 51 | +Azure AD Connect can be configured to synchronize the required NTLM or Kerberos password hashes for Azure AD DS. Make sure that you have completed the steps to [enable Azure AD Connect for password hash synchronization][enable-azure-ad-connect]. If you had an existing instance of Azure AD Connect, [download and update to the latest version][azure-ad-connect-download] to make sure you can synchronize the legacy password hashes for NTLM and Kerberos. This functionality isn't available in early releases of Azure AD Connect or with the legacy DirSync tool. Azure AD Connect version *1.1.614.0* or later is required. |
| 52 | + |
| 53 | +## Enable synchronization of password hashes |
| 54 | + |
| 55 | +With Azure AD Connect installed and configured to synchronize with Azure AD, now configure the legacy password hash sync for NTLM and Kerberos. A PowerShell script is used to configure the required settings and then start a full password synchronization to Azure AD. When that Azure AD Connect password hash synchronization process is complete, users can sign in to applications through Azure AD DS that use legacy NTLM or Kerberos password hashes. |
| 56 | + |
| 57 | +1. On the computer with Azure AD Connect installed, from the Start menu, open the **Azure AD Connect > Synchronization Service**. |
| 58 | +1. Select the **Connectors** tab. The connection information used to establish the synchronization between the on-premises AD DS environment and Azure AD are listed. |
| 59 | + |
| 60 | + The **Type** indicates either *Windows Azure Active Directory (Microsoft)* for the Azure AD connector or *Active Directory Domain Services* for the on-premises AD DS connector. Make a note of the connector names to use in the PowerShell script in the next step. |
| 61 | + |
| 62 | +  |
| 63 | + |
| 64 | + In this example screenshot, the following connectors are used: |
| 65 | + |
| 66 | + * The Azure AD connector is named *contoso.onmicrosoft.com - AAD* |
| 67 | + * The on-premises AD DS connector is named *onprem.contoso.com* |
| 68 | + |
| 69 | +1. Copy and paste the following PowerShell script to the computer with Azure AD Connect installed. The script triggers a full password sync that includes legacy password hashes. Update the `$azureadConnector` and `$adConnector` variables with the connector names from the previous step. |
| 70 | + |
| 71 | + Run this script on each AD forest to synchronize on-premises account NTLM and Kerberos password hashes to Azure AD. |
| 72 | + |
| 73 | + ```powershell |
| 74 | + # Define the Azure AD Connect connector names and import the required PowerShell module |
| 75 | + $azureadConnector = "<CASE SENSITIVE AZURE AD CONNECTOR NAME>" |
| 76 | + $adConnector = "<CASE SENSITIVE AD DS CONNECTOR NAME>" |
| 77 | + Import-Module "C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\AdSyncConfig.psm1" |
| 78 | +
|
| 79 | + # Create a new ForceFullPasswordSync configuration parameter object then |
| 80 | + # update the existing connector with this new configuration |
| 81 | + $c = Get-ADSyncConnector -Name $adConnector |
| 82 | + $p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter "Microsoft.Synchronize.ForceFullPasswordSync", String, ConnectorGlobal, $null, $null, $null |
| 83 | + $p.Value = 1 |
| 84 | + $c.GlobalParameters.Remove($p.Name) |
| 85 | + $c.GlobalParameters.Add($p) |
| 86 | + $c = Add-ADSyncConnector -Connector $c |
| 87 | +
|
| 88 | + # Disable and re-enable Azure AD Connect to force a full password synchronization |
| 89 | + Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $azureadConnector -Enable $false |
| 90 | + Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $azureadConnector -Enable $true |
| 91 | + ``` |
| 92 | +
|
| 93 | + Depending on the size of your directory in terms of number of accounts and groups, synchronization of the legacy password hashes to Azure AD may take some time. The passwords are then synchronized to the Azure AD DS managed domain after they've synchronized to Azure AD. |
| 94 | +
|
| 95 | +## Next steps |
| 96 | +
|
| 97 | +In this tutorial, you learned: |
| 98 | +
|
| 99 | +> [!div class="checklist"] |
| 100 | +> * Why legacy NTLM and Kerberos password hashes are needed |
| 101 | +> * How to configure legacy password hash synchronization for Azure AD Connect |
| 102 | +
|
| 103 | +> [!div class="nextstepaction"] |
| 104 | +> [Learn how synchronization works in an Azure AD Domain Services managed domain](synchronization.md) |
| 105 | +
|
| 106 | +<!-- INTERNAL LINKS --> |
| 107 | +[create-azure-ad-tenant]: ../active-directory/fundamentals/sign-up-organization.md |
| 108 | +[associate-azure-ad-tenant]: ../active-directory/fundamentals/active-directory-how-subscriptions-associated-directory.md |
| 109 | +[create-azure-ad-ds-instance]: tutorial-create-instance.md |
| 110 | +[enable-azure-ad-connect]: ../active-directory/hybrid/how-to-connect-install-express.md |
| 111 | +
|
| 112 | +<!-- EXTERNAL LINKS --> |
| 113 | +[azure-ad-connect-download]: https://www.microsoft.com/download/details.aspx?id=47594 |
0 commit comments