Azure AD Connect : PowerShell script to check the AD Connect Password Sync status and send E-mail to Admins

Hello All,

Here is the PowerShell script to send an email to DL about the status of the password sync in a CSV.

Here i have used Get-MsolCompanyInformation.
this gives details like,
last sync time
last password sync time
technical notification email
service account used to perform the sync.

this has to be run on the AD Connect server with elevated rights.
before  running, get-msolcompany information you need to connect to azure.
so open PowerShell with admin rights,
run Connect -msolservice ( in the pop up enter the Global admin credentials)
now run the below script, this store the csv file in the path and also send an email to the address specified.

You can also store the encrypted creds in the script. this is an easy way.

post your suggestions and thoughts in the comments



###########AD CONNECT  PASSWORD SYNC STATUS######## 

$fromaddress = "user@abc.com" 
$toaddress = "adminDL@abc.com" 
 $ADConnect = get-MsolCompanyInformation >\\"path to write the output in csv"\ADC.csv
 $body =   "Please Find the Sync Scheduler info of AD CONNECT attached in the CSV and take actions if necessary. THANK YOU!!" 
 $date = get-date
$Subject = " $date : Pls See the state of AD Connect Sync" 

$attachment = "\\"path of the folder whee teh output csv is located"\Documents\11\ADC.csv" 
$smtpserver = "SMTP.abc.com" 

#################################### 

$message = new-object System.Net.Mail.MailMessage $message.From = $fromaddress
$message.To.Add($toaddress)
###############################################



$message.Subject = $Subject
$attach = new-object Net.Mail.Attachment($attachment)
$message.Attachments.Add($attach)
$message.body = $body 

$smtp = new-object Net.Mail.SmtpClient($smtpserver)
$smtp.Send($message) 

VERIFICATION OF SUCESSFULL INSTALLATION AND CONFIGURATION OF AD CONNECT

STEP 1 -Verifying in Azure AD Portal:

 Log into Azure AD portal with Global Admin Credentials
 In the home page click Azure Active directory => AD Connect in the left blade
 Check Sync Status and Last sync timings


STEP 2 – checking through PowerShell:

 Log into PowerShell in the AD Connect server with elevated rights,
 Run Get-ADSyncScheduler
 The Value of “SyncCycleEnabled” has to be “True”

SAMPLE:

PS C:\Windows\system32> get-Adsyncscheduler

AllowedSyncCycleInterval            : 00:30:00

CurrentlyEffectiveSyncCycleInterval : 00:30:00

CustomizedSyncCycleInterval         :

NextSyncCyclePolicyType             : Delta

NextSyncCycleStartTimeInUTC         : 12/19/2019 1:00:20 PM

PurgeRunHistoryInterval             : 7.00:00:00

SyncCycleEnabled                    : True

MaintenanceEnabled                  : True

StagingModeEnabled                  : True

SchedulerSuspended                  : False

SyncCycleInProgress                 : False

STEP 3 – checking User profiles:

 Log into Portal.azure.com with GA credentials
 Azure Active Directory => Users
 You should be able to see users with Source as Windows server AD.

run, (Get-ADSyncGlobalSettings).Parameters | Select Name,Value

in powershell with elevated rights. The above command will give you the details of your company`s Ad Connect configurations. It also has AD Connect version.Alternatively you can check from Control panel.

PS C:\Windows\system32> (Get-ADSyncGlobalSettings).Parameters | select Name,Value

Name                                                   Value

----                                                   -----

Microsoft.Synchronize.SynchronizationPolicy            Delta

Microsoft.Synchronize.StagingMode                      True

Microsoft.SynchronizationOption.JoinCriteria           AlwaysProvision

Microsoft.UserSignIn.DesktopSsoEnabled                 False

Microsoft.Synchronize.MaintenanceEnabled               True

Microsoft.OptionalFeature.ExportDeletionThresholdValue 500

Microsoft.Version.SynchronizationRuleImmutableTag      V1

Microsoft.SynchronizationOption.AnchorAttribute        mS-DS-ConsistencyGuid

Microsoft.OptionalFeature.DirectoryExtensionAttributes

Microsoft.OptionalFeature.FilterAAD                    False

Microsoft.GroupWriteBack.Forest

Microsoft.GroupWriteBack.Container

Microsoft.SynchronizationOption.UPNAttribute           userPrincipalName

Microsoft.Synchronize.SchedulerSuspended               False

Microsoft.OptionalFeature.DirectoryExtension           False

Microsoft.SynchronizationOption.CustomAttribute

Microsoft.Synchronize.TimeInterval                     00:30:00

Microsoft.Synchronize.ServerConfigurationVersion       1.4.32.0

Microsoft.SystemInformation.MachineRole                RoleMemberServer

Microsoft.AADFilter.AttributeExclusionList

Microsoft.OptionalFeature.DeviceWriteBack              False

Microsoft.OptionalFeature.AutoUpgradeState             Suspended

Microsoft.Synchronize.NextStartTime                    Thu, 19 Dec 2019 13:00:20 GMT

Microsoft.Synchronize.RunHistoryPurgeInterval          7.00:00:00

Microsoft.OptionalFeature.GroupFiltering               False

Microsoft.ConnectDirectories.WizardDirectoryMode       AD

Microsoft.Synchronize.SynchronizationSchedule          True

Microsoft.OptionalFeature.ExchangeMailPublicFolder     False

Microsoft.OptionalFeature.UserWriteBack                False

Microsoft.OptionalFeature.ExportDeletionThreshold      True

Microsoft.DeviceWriteBack.Forest

Microsoft.OptionalFeature.DeviceWriteUp                True

Microsoft.OptionalFeature.HybridExchange               False

Microsoft.AADFilter.ApplicationList

Microsoft.DirectoryExtension.SourceTargetAttributesMap

Microsoft.UserWriteBack.Forest

Microsoft.DeviceWriteBack.Container

Microsoft.UserWriteBack.Container

Microsoft.UserSignIn.SignOnMethod                      PasswordHashSync

Microsoft.OptionalFeature.GroupWriteBack               False

Connect-msolservice   // connect to Ms online service , use Global Admin  credentials

Get-MsolCompanyInformation

gives info about last sync cycle, password syn enabled or not etc

In the Synchronization Service Manager, any import or export operation with on-premises AD fails with no-start-credentials error. ==(or)== Under Windows Event Viewer, the application event log contains an error with Event ID 6000 and message 'The management agent "abc.com" failed to run because the credentials were invalid'.

If you get any of the following error messages in AAD Connect try the following steps mentioned here.


Error Message:


In the Synchronization Service Manager, any import or export operation with on-premises AD fails with no-start-credentials error.

Under Windows Event Viewer, the application event log contains an error with Event ID 6000 and message 'The management agent "abc.com" failed to run because the credentials were invalid'.

Steps to be followed:

Start the Synchronization Service Manager (START → Synchronization Service).

go to the “Connectors” tab and right click on the connectors name

Under Actions, select Properties.

In the pop-up dialog, select Connect to Active Directory Forest:

Enter the new password

Click OK to save the new password and close

Restart the Azure AD Connect Synchronization Service under Windows Service Control Manager. This is to ensure that any reference to the old password is removed from the memory cache.

Type in the comment if it was helpful or not.


Thanks for Reading :) 

//
Senko