Use and Manage the Active Directory Integration (ADI)

The JumpCloud Active Directory Integration (ADI) enables the syncing of users, groups, and passwords between JumpCloud and on-premise or off-premise AD. As covered in Get Started with the Active Directory Integration, the ADI uses two agents: an import agent and a sync agent that can be installed in three (3) configurations.  The configurations are determined by where you want to manage users, groups, and passwords.

1. Manage users, groups, and passwords in AD
2. Manage users and passwords in either system, or both
3. Manage users, groups, and passwords in JumpCloud

This article covers how to leverage the ADI depending on your configuration and use case. 

Prerequisites

• You’ve read and are familiar with the concepts in step 1 of this series, Get Started with the Active Directory Integration (ADI).
• The ADI agent(s) are installed and running on your AD servers. See Configure the Active Directory Integration.

Sync interval

The ADI import agents check for updates to users and security groups in the ADI security group (typically named JumpCloud or) in AD every 90 seconds, by default.

The ADI sync agent checks for updates to users and user groups connected to ADI in JumpCloud every 5 seconds.

Use cases and workflows

The table shows a summary of the most common use cases and the ADI configurations that support them.  Reference Configure the Active Directory Integration for more information.

Workflow for Managing Users, Groups, and Passwords in AD

When JumpCloud ADI is configured for AD Import only, the illustrations below show the user identity workflows for any user data changes or password updates in this configuration. This method allows Admins to extend their AD Users and Passwords to JumpCloud. JumpCloud can then extend these identities out to resources, such as RADIUS WiFi or VPN networks, SSO Applications, LDAP resources, and more.

If you’re only using AD Import, continue to the Using AD Import section of this article and disregard the Using AD Sync section. 

AD Import Agent Only – Single Domain Workflow

AD Import Agent Only – Multiple Domain Workflow

Workflow for Managing Users, Groups, and Passwords in AD, JumpCloud, or Both

When the JumpCloud ADI is configured for AD Import and AD Sync, the illustrations below show the user identity workflow for any changes or password updates in this configuration. This scenario allows Admins to not only extend their AD users and Passwords to JumpCloud but to also allow JumpCloud to manage identities and passwords within AD for synced users.

Two-way Sync – Single Domain Workflow

Two-way Sync – Multiple Domain Workflow

Workflow for Managing Users, Groups, and Passwords in JumpCloud

When the JumpCloud ADI is configured for AD Sync only, the illustrations below show the user identity workflow for any changes or password updates in this configuration. This scenario allows Admins to manage identities and passwords within AD solely from JumpCloud for synced users.

AD Sync Agent Only – Single Domain Workflow

AD Sync Agent Only – Multiple Domain Workflow

Considerations

Password Considerations

• Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements
• Users imported from AD to JumpCloud will have their Password Authority set to None (JumpCloud). This setting can be changed from Users>More Actions>Set External Password Authority or directly from the User Details page
• When the JumpCloud AD import agent is installed on member servers, the AD password does NOT sync to JumpCloud:
  • This configuration is used when user passwords are managed in JumpCloud
  • Users imported from AD will not have their AD password stored on their initial login to JumpCloud nor will the password sync from AD to JumpCloud
  • When a user's Password Authority is set to None (JumpCloud) the password can set and managed in JumpCloud.

• When the JumpCloud AD import agent is installed on all DCs, the AD password does sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud.
  • When a user's Password Authority is set to None (JumpCloud):
    • Passwords can be managed in AD, JumpCloud, or both.
    • Password expiration notifications are sent from JumpCloud.
  • When a user's Password Authority is set to Active Directory:
    • The password cannot be set or changed password in JumpCloud, with the exception of the link from the password expiration notification.
    • Passwords must be managed in AD.
    • Password expiration notifications are sent from JumpCloud.

User Sync Considerations

• Synced users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync.
• The JumpCloud ADI import and sync agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI won’t work properly 

Sync from AD to JumpCloud

• We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory.
  • If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations.
• To sync users from AD to JumpCloud, users must be members of the ADI specific Security Group (e.g., “JumpCloud” or "JumpCloud -Domain1") or of a Security Group nested under this Security Group
• Users who are imported from AD to JumpCloud will automatically have their Password Authority set to Active Directory by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.
• You can manage users in 2 ways:
  • Individually by adding them to the security group created for this integration, located in the designated OU 
  • Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group
• ADI Import Agent settings in the jcadimportagent.config.json file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD
  • Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file
• Removing users from the JumpCloud Integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file 
• Importing privileged user accounts, such as Domain Admins and accounts with “adminCount=1”, into JumpCloud from AD, isn’t supported.
• The Password Authority setting can be changed for a specific user from their user record directly or for multiple users from Users >More Actions>Set External Password Authority.

Export and sync from JumpCloud to AD

• Users created in AD from JumpCloud are created in the AD root container unless a different root container is specified during installation.

Using the AD Import Agent

The AD import agent allows you to do the following in JumpCloud from AD:

1. Import, update, suspend, and delete users 
2. Create groups
3. Manage group membership
4. Delegate authentication (AD validates the user's credentials)

If the AD import agent is installed on a DC, it also allows you to:

• Sync the user’s password from AD to JumpCloud

To import users from AD into JumpCloud

The AD Import Agent will only import users that you directly add as a memberOf the JumpCloud ADI Security Group within AD (i.e., the Security Group you created during the AD Import Agent installation).

There are two ways to specify which users to import from AD to JumpCloud: 

1. through a direct membership to the JumpCloud ADI Security Group
2. through a Security Group that is a member of the JumpCloud ADI Security Group

To import a single user from AD to JumpCloud

1. Open the Active Directory Users and Computers (ADUC) Menu by clicking the start button, typing “dsa” and clicking the Active Directory Users and Computers icon.

2. Once ADUC is open, navigate to a user that you would like to import into JumpCloud. 
3. Right-click on the target user and click Properties.

4. Navigate to the Member Of tab in the Properties menu. 

5. Click Add. Then add this user as a member of the JumpCloud ADI Security Group.

6. Click Apply. Wait up to 90 seconds and then check to see if the user has been fully imported into JumpCloud. This validates that your AD Import Agent is working appropriately.

The user is created with a Password Status of Password Pending and will have an AD Integration badge below their email address. The user state is controlled by setting for Users>Settings>Default User State for User Creation> Manual/Single User API. See Manage User States for more information about this setting.

To import multiple users from AD into JumpCloud:

This method allows you to import all users that are members of a specific Security Group. For example, if you want to export all AD users that are members of the Accounting Security Group, you would make the Accounting Security Group a memberOf the JumpCloud ADI Security Group. This will then import the Accounting Security Group and all users that are associated members.

1. Open the Active Directory Users and Computers (ADUC) Menu by clicking the start button, typing “dsa” and clicking the Active Directory Users and Computers icon.

2. Once ADUC is open, navigate to a user that you would like to import into JumpCloud. 
3. Right-click on the target Security Group and click Properties.

4. In the Security Group Properties Menu, click the Member Of tab and click Add.

5. Add this Security Group to the JumpCloud-named Security Group and click Apply.
6. Wait 90 seconds for both the Security Group and the Users within that Security Group to be created in JumpCloud. You will see both the user accounts and user groups within JumpCloud’s Admin Portal marked by an AD Integration badge.

To manage passwords

To manage passwords in a one-way sync from AD to JumpCloud (Managing Users, Groups, and Passwords in AD)

In this configuration, the delegated authentication setting, Delegated Password Validation, is enabled by default and cannot be disabled in the ADI configuration. This means whenever an AD imported user logs in to the JumpCloud user portal or performs a JumpCloud SSO login, their password is validated by AD and not JumpCloud.

New users

Users imported from AD into JumpCloud, can log in to JumpCloud immediately using their company email address and AD password.

When AD users are imported from AD into JumpCloud, there is no password associated with their account in JumpCloud. The Password Authority and Delegated Authority are automatically set to Active Directory on their user record. The Password Status will be Delegated and show as "Managed by AD".

If the import agent is installed on a member server:

• The user's password will never sync from AD to JumpCloud and will never be stored in JumpCloud.

If the import agent is installed on a DC:

• The user's AD password will be stored in JumpCloud the first time the user logs into the JumpCloud user portal and will sync from that point forward.

To manage passwords in a two-way sync from AD to JumpCloud (Managing Users, Groups, and Passwords in AD, JumpCloud, or Both)

In this configuration, the delegated authentication setting, Delegated Password Validation, is disabled by default and is editable. This means the user must have an active password in JumpCloud to log in to the JumpCloud user portal or performs a JumpCloud SSO login.

When AD users are imported from AD into JumpCloud, there is no password associated with their account in JumpCloud. The Password Authority is set to None (JumpCloud) and Delegated Authority is set to None on their user record by default.

Until the user sets a password in JumpCloud or changes their password in AD if the import agent is installed on a DC, You’ll see the newly imported users in JumpCloud marked with an AD badge and in an orange Password Pending password status within the user menu.

To sync a password from AD to JumpCloud

1. When a user's Delegated Authority is set to Active Directory,
   • The user's AD password will be stored in JumpCloud the first time the user logs into the JumpCloud user portal and will sync from that point forward.
   • Password changes will sync within 90 seconds after the user changes their password in AD or on an AD-managed resource
2. When a user's Delegated Authority is set to None,
   • The user will need to change their password in AD or on an AD-managed resource before they can log in to the JumpCloud user portal or with JumpCloud SSO. 
   • Password changes will sync within 90 seconds after the user changes their password in AD or on an AD-managed resource. In the JumpCloud Admin Portal Users page, the user’s Password Status will be a green check-marked active statuswith the expiry date from  AD.

3. All Password changes moving forward will need to be done within AD or on AD-bound resources. 

To create, update, and disable user accounts

Now that AD Import has been successfully installed and configured, AD Admins will be able to manage JumpCloud user accounts and the following attributes within AD for any CrUD updated (Create, Update, and Deactivate/Disable):

• firstname
• lastname
• username
• email
• password, and
• user state (active or disabled)

If the SyncAdditionalAttributes setting is true in the jcadimportagent.config.json file, the following attributes are also updated:

• displayname
• description
• JobTitle
• department
• company
• location
• employeeType
• phoneNumbers
• addresses
• manager 

Creating new users in JumpCloud from AD

Follow the same process outlined above for importing users from AD into JumpCloud.

To create new users in AD and JumpCloud:

1. Create a new user account in AD
2. Add the user to the JumpCloud ADI security group
3. Wait 90 seconds
4. Verify the user was created in JumpCloud.

To import an existing AD user in JumpCloud:

1. Add an existing AD user to the JumpCloud ADI security group
2. Wait 90 seconds
3. Verify the user was created in JumpCloud.

Updating user attributes in JumpCloud from AD

When you change any attributes of an AD user which is currently synced via the AD Import Agent, this will reflect within your JumpCloud tenant in approximately 90 seconds. For example, if you change the First or Last Name of a user, this will reflect on the JumpCloud user’s First or Last Name attribute in 90 seconds. 

Suspending or deleting users in JumpCloud from AD

When deleting, suspending, or deactivating users within AD, this will in turn either suspend or delete the users in JumpCloud thus removing access to any of the JumpCloud-managed resources he or she had access to such as RADIUS, LDAP, or SSO Applications. The specific behavior is determined by the settings in the jcadimportagent.config.json file.

Using AD Sync

If you’re choosing to also leverage the functionality of AD Sync Agent with your AD Integration, this allows JumpCloud to push CrUD changes of synced users down to AD. With the AD Sync Agent in place, you will be able to do the following: 

1. Create users in JumpCloud which will then push down to AD.
2. When users change passwords in JumpCloud, this new password will be pushed down to their AD user account. 
3. When you suspend or delete a user in JumpCloud, this will disable the user Account in AD. 

AD Sync Agent Recommendations

• We recommend creating a security group named JumpCloud Admins. This group isn’t synced to the JumpCloud Administrator Portal, but is used to identify any accounts that you want to be Global Administrators or Sudo users in JumpCloud. Any user that is a member of this group and also a member of the JumpCloud group will be granted Admin/Sudo privileges on all device associations to which they are bound by default. This function doesn't support members of nested groups
• For full bidirectional synchronization, we recommend that all Users and Groups be synchronized with JumpCloud, live under a single OU (Root User Container) in Active Directory. This can be the default CN=Users container in AD or an alternate custom OU within the directory
• To manage users in different OUs, we recommend that these OUs be located underneath the primary Root User container. Users or groups located in these containers that are made members of the JumpCloud ADI security group allow AD Sync to properly synchronize passwords and attributes associated with those users 
• We recommend that you align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise passwords may not replicate if they’re rejected by the destination directory’s complexity requirements
• We recommend that you set the service account you use to authorize AD Sync's access to AD with a password that doesn't expire if your security requirements allow this. If this isn't permissible with your security compliance levels, then we recommend scheduling a maintenance window to reinstall the AD sync agent every time the service account password changes

AD Sync Agent Considerations

• If you relocate users in AD, you could disrupt password synchronization
• If you remove users or groups from the JumpCloud ADI security group in AD they’re removed from the JumpCloud Admin Portal per the default AD Sync configuration options
• Managing privileged user accounts such as Domain Admins in AD isn't supported, see AdminSDHolder, Protected Groups and Security Descriptor Propagator. Active Directory flags privileged accounts with “adminCount=1” in the directory, which results in any inherited permissions granted to the JumpCloud AD agent services to be removed. This prevents JumpCloud from being able to effectively manage those privileged accounts. 
• Synchronization runs at approximately 5 second intervals
• If the password of the service account that is used to Authorize AD Sync's access to AD is changed, the AD Sync agent will need to be uninstalled and reinstalled with the updated password
• When using both AD Sync and AD Import agents, password expiration notifications are not sent to the end user or administrator. This can be counterintuitive due to the fact that AD Sync gives JumpCloud control over the user attributes and password

AD Sync Agent User Attribute Synchronization

JumpCloud AD Sync can manage the following data fields in AD:

• Password
• First Name
• Last Name
• Email
• Windows UserAccountControl flag for ACCOUNTDISABLE - this field is used for syncing the JumpCloud account status. Currently, JumpCloud only writes back a suspend status to AD. When a user is suspended in JumpCloud, JumpCloud disables the user in AD through the Sync agent. Learn more about Configure ADI.
• MemberOf - this field is used to track group membership in AD. For this field to be synced, you need to install Sync agent v 2.26.0 or later. Learn how to Configure ADI.

JumpCloud Users are associated with Active Directory Users based on the alignment of the Username and Email fields of users in JumpCloud and Active Directory. See Configure ADI for UserFieldMapping settings configured in the AD Import agent that define the username field of the AD User.

Group Attribute Synchronization

JumpCloud syncs the following data fields with AD Sync for groups:

• Group Name

User and Group Management

To provision users to AD

The JumpCloud ADI security group that’s created during AD Import installation is the primary management group for AD integration. This group is used to define the scope of user management with AD and allows full bidirectional synchronization between AD and JumpCloud.

User Creation

You can create users in JumpCloud and connect them to an AD Domain using AD Sync. You can connect users to an AD Domain from the following places in the Admin Portal:

• User panel Directories tab
• Directories panel User tab

When you connect a user to an AD Domain, JumpCloud determines if a user with the same username exists on the domain. If a user with the same username doesn't exist, JumpCloud creates a user with the JumpCloud username on the AD Domain and generates a random password for the user. If a user with the same username exists on the domain, JumpCloud takes over the account, but doesn't generate a random password for the user.

To add a user to an AD Domain from the Users panel

1. Go to USER MANAGEMENT > Users.
2. Select a user to view their details.
3. Select the Directories tab.
4. Select the AD Domain you want to connect the user to.
5. Click save user.

To add a user to an AD Domain from the Directories panel

1. Go to DIRECTORY INTEGRATIONS > Active Directory.
2. Select an AD Domain to view its details.
3. Select the Users tab.
4. Select a user to connect to the AD Domain.
5. Click save.

To sync an existing user from JumpCloud to AD 

This functionality allows JumpCloud users to be created in AD if they don’t exist or allows JumpCloud to either take over management of the user if you have configured a one-way sync from JumpCloud to AD (only the AD sync agent is running) or co-manage the user with AD in a 2-way sync configuration (both the AD import and AD sync agents are running).

Follow the steps below to sync users from JumpCloud to AD.

1. Navigate to your user in JumpCloud and open up their Details. 
2. Click on the user groups tab on the user aside. 
3. Assign user to a JumpCloud group and click Save.
4. Wait for Active Directory badge to appear.

5. Bind this user to the user group which they need to be a memberOf in AD (that is also synced using the ADI). In our example, we can see the Accounting User Group is tied to AD via the Directories in the drop-down menu.

6. Click Save User. The user will then be created in the Root User Container within your AD domain. This can take up to 90 seconds.

To create, update and deactivate user accounts

The following section covers how to manage AD user accounts from JumpCloud. With the AD Sync in place, JumpCloud Admins are able to manage AD users from the JumpCloud Admin Portal. This makes user onboarding, off-boarding, and management much easier. Additionally, this may help with removing the need to remotely access the DC for simple tasks within the Identity Lifecycle for user accounts.

Creating Users in JumpCloud

JumpCloud Admins can create users in AD by binding any JumpCloud user to an AD Integrated User Group within JumpCloud. For example, if you’ve synced the Accounting group from AD to JumpCloud via the Import Agent, then any JumpCloud user bound to this synced user group will be created within AD under the Root User Container. 

The user is created within AD, is a memberOf the associated user group (Security Group in AD), and their AD user account will use their JumpCloud Password. 

Suspending or deleting users in JumpCloud

Suspending or deleting users within JumpCloud will Disable the user account within AD. JumpCloud in any form will never remove or delete user accounts in any of the 3rd party integrations. (This also includes SAML, LDAP, AD, GWS, and M365). These changes will reflect in 5 seconds.

Group Synchronization: Managing Groups from AD

• Groups added to the JumpCloud ADI security group in AD are replicated to the JumpCloud Admin Portal along with all of the users that are a member of that group. Because JumpCloud doesn’t support nested groups directly, any groups in AD that are nested in another group are traversed recursively and their structure is flattened. Users are made a member of their primary group in JumpCloud and a member of the group in which they’re nested in in AD. For example, in AD, Group1 is a member of the JumpCloud group with members User1, User2 and Group2. Group2 is a member of Group1 and contains members User3 and User4. In JumpCloud, Group2 is mirrored and User3 and User4 are bound. Group 1 is mirrored and User1, User2, User3 and User4 are bound
• To manage group membership from JumpCloud to AD, and assign the memberOf attribute to a user account in AD, the AD bound groups in JumpCloud are required to live under the configured Root User container as configured during AD Sync agent installation with the proper delegated controls and permissions
• Users that only exist in JumpCloud may also be bound to these groups in your JumpCloud Administrator Portal. 
• For alternate authoritative scenarios or more details regarding synchronization use cases, see use cases in Get Started: ADI or contact JumpCloud for additional support

Service Details

The agent is registered as a service to start automatically.

• Display name: JumpCloud AD Sync Agent
• Service name: JCADSyncAgent
• Log located at C:\Program Files\JumpCloud\AD Sync\adsync.log

User Experience

Flow for Active Users

An active user is a user in an 'active' user state, has a password, and that password status is 'active'. After an administrator binds an active user to an external directory, the user receives an email telling them the directory they’ve been added to, and to sync their password by logging into their User Portal.

Users That are Bound to More Than One External Directory

They will receive a new email for each individual external directory that they are bound to. The flow for users bound to more than one external directory is the same as for active users. 

Flow for New Users

A new user is a user in an 'active' user state with a password status of 'password pending'. After an administrator binds a new user without a password to an external directory, the user receives a Welcome to JumpCloud (activation) email that takes them through how to register their new account. After the user registers their account, creates an account password, and logs in to their User Portal, their password is sent to the directories they’re bound to, and JumpCloud will manage their password.

Managing ADI

To update agents

We recommend keeping your agents current to ensure you have the latest security updates, bug fixes, and functionality and to retain support. 

1. Log in to the JumpCloud Admin Portal.
2. Go to Directory Integrations > Active Directory.
3. Select your AD domain
4. In the Downloads section, select
5. Select a download location
6. Upload the agent installation file to the server where the agent is already installed
7. Run the installation wizard
8. Only minimal installation screens are shown.
   1. Directory for where the installation should occur
   2. Finish screen
9. Restart the service.

To manage agents in JumpCloud

1. Log in to the JumpCloud Admin Portal.
2. Go to Directory Integrations > Active Directory.
3. Select your AD domain
4. Click the pause to temporarily stop the agent.

5. Click delete to remove the agent from JumpCloud.

To change the Primary AD Import Agent Role to another Domain Controller

1. Log in to the JumpCloud Admin Portal.
2. Go to Directory Integrations > Active Directory.
3. Select your AD domain.
4. Pause all the running agents except for the the Domain Controller that you would like to designate as the Primary Import Agent.
5. After a short time period, the currently running Import agent will become the Primary Import agent.
6. Unpause the remaining agents.

To rotate ADI service account passwords in AD

The ADI import and sync service account passwords should be rotated on a regular basis for security purposes.  

Rotating the ADI import service account (jcimport) password:

1. Log in to a Domain Controller with an AD domain admin account
2. Open the registry
3. Navigate to HKLM\SOFTWARE\JumpCloud\AD Integration Import Agent\ldap
4. Edit bind_password
5. Enter the new password in the Value data field
6. Click OK
7. Open services.msc
8. Restart the JumpCloud AD Integration Import Agent service.

Rotating the AD sync service account (jcsync) password:

1. Log in to a Domain Controller with an AD domain admin account
2. Open the registry
3. Navigate to HKLM\SOFTWARE\JumpCloud\AD Integration Sync Agent\ldap
4. Edit bind_password
5. Enter the new password in the Value data field
6. Click OK
7. Open services.msc
8. Restart the JumpCloud AD Integration Import Agent service.

To change ADI Use Case

For detailed instructions on changing your ADI deployment configuration, read ADI: Change Configuration.

1. Log in to the JumpCloud Admin Portal.
2. Go to Directory Integrations > Active Directory.
3. Select your AD domain
4. Click Update Configuration
5. Select the new deployment configuration
6. Click Next
7. Follow the steps on each screen.

To manage ADI services in AD

1. Open services.msc
2. Select the AD service (JumpCloud AD integration Sync Agent or JumpCloud AD integration Import Agent)
3. Select the desired action: start, stop, restart

To modify agent configuration

Modifying the AD Import Agent Configuration

1. Review Advanced Configurations for ADI to understand the configuration settings available for the import agent.
2. In AD, go to the JumpCloud folder where the AD Import agent is installed on a domain controller.
3. Open the adint.config.json file using a text editor
4. Edit the configurations in the “MainLoop” section of the file.
5. Repeat this process for the configuration file on every AD server (DC controller on which AD Import is installed.

To modify the Root User container 

If you decide to use a different Root user container for managing AD resources then you will want to modify or validate the configured Root User container location.

Verifying the full LDAP path for the chosen Root user container you have selected in ADUC

1. From the ADUC panel’s View menu, enable Advanced Features. 
2. Right-click the container and select Properties. 
3. Select the Attribute Editor tab. 
4. Select the “distinguishedName” attribute, then click View.

Modifying the Root User container in AD sync configuration settings

Stop the JumpCloud AD Integration Sync service and make the required Sync Agent config changes:

1. Open Registry Editor by clicking the Start button and typing in regedit. Click on the Registry Editor icon.

2. Navigate to the following Registry Folder: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\JumpCloud\AD Sync.
3. There should be a Key (looks like a folder) named ldap. If there is not, please create this Key in the registry and name it ldap.
4. Open the ldap Key.

5. You should see a Key labeled user_root_dn. You should also see the value with the targeted Root User Container you specified during install of the AD Sync Agent. If the user_root_dn value does not look correct, you can update it by double-clicking the key and updating the value to match your Root User Container. 
6. Once updated, you need to start the JumpCloud AD integration Sync Agent service within services.msc.

To uninstall agents from AD servers

1. Open Program Files.
2. Find the program associated with the agent you want to uninstall (JumpCloud AD Import or JumpCloud AD Sync)
3. Uninstall

Integration with Entra Connect

When AD Sync and/or AD Import tools are installed on the Windows Server that also has Entra Connect or Entra Connect cloud sync installed, your JumpCloud tenant can NOT be bound to your Entra ID or Microsoft O365 tenant. If Entra ID Connect is the only AD tool installed on the Windows Server this too will NOT work with an Entra ID tenant bound to a JumpCloud tenant.

When JumpCloud is bound to an Entra ID tenant, password syncing will not correctly propagate from JumpCloud to Entra ID. Additionally, it will cause unintended interference with Microsoft’s Entra ID password policy, which will prevent Microsoft users from resetting their own passwords using Microsoft’s Self Service Password Reset (SSPR) portal.  Lastly, there will be two password authorities, (on-prem) Active Directory & JumpCloud, constantly in conflict with one another—trying to write the same changes to Entra ID.

Bearing all of this in mind, you may have Microsoft and JumpCloud AD tools concurrently installed on a Windows Server on the premise JumpCloud is NOT bound to an Entra ID tenant.

Lastly, we have confirmed that enabling both ‘Password writeback’ and ‘Sync password hashes’ in Entra Connect & Entra Connect Cloud Sync tools does not prevent our AD Integration tools from updating passwords for user identities managed both in your on-prem AD domain and JumpCloud tenant.

Want additional assistance from JumpCloud?

If you’re having issues with getting JumpCloud’s AD Integration working, see the Troubleshooting Guide.JumpCloud now offers a myriad professional services offerings to assist customers with implementing and configuring JumpCloud. If you’re looking for assistance with Migrating from AD, or to integrate AD with JumpCloud, we recommend you reach out to JumpCloud’s Professional Services team on the following page: Professional Services - JumpCloud.