This article provides a step-by-step guide for configuring ADI to manage users, security groups, and passwords in AD, JumpCloud, or both<\/strong>. This configuration provides the greatest flexibility. It allows AD and JumpCloud to manage user credentials and attributes together in unison, a full two-way sync. Users are able to change passwords within either AD or JumpCloud. It also supports a hybrid approach where specific information is managed in one system and other information is managed in the other system. This configuration supports:<\/p>\n\n\n\n
- \n
- Data syncs bidirectionally between JumpCloud and AD<\/li>\n\n\n\n
- Passwords managed in either system or both<\/li>\n\n\n\n
- Users created, updated, and deactivated in either system or both<\/li>\n\n\n\n
- User (security) groups created and managed in either system or both<\/li>\n\n\n\n
- Group membership managed in either system or both<\/li>\n<\/ul>\n\n\n\n
Deployment Configuration Overview<\/h2>\n\n\n\n
- \n
- Use both the ADI import agent and ADI sync agent<\/li>\n\n\n\n
- Install agents on either domain controllers (DCs) or member servers<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \nTo sync passwords from AD to JumpCloud, the import agent must be installed on all<\/strong><\/em> DCs.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Add users and security groups under the ADI security group in AD to sync from AD to JumpCloud<\/li>\n\n\n\n
- Assign users and user groups to the ADI AD domain in JumpCloud to sync from JumpCloud to AD<\/li>\n<\/ul>\n\n\n\n
To explore the use cases and benefits of this configuration see Manage users and passwords in either system, or both<\/a> in the Configure Active Directory Integration (ADI)<\/a> help center article.<\/p>\n\n\n\n
Workflows<\/h2>\n\n\n\n
Two-way sync – single domain<\/h3>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/two-way-sync-single-domain-1024x455.png\")
<\/figure>\n\n\n\nTwo-way sync – multiple domains<\/h3>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/10\/two-way-sync-multi-domain-1024x844.png\")
<\/figure>\n\n\n\nTo learn more about the general user identity workflow and expected behavior for any user, group, and password change after the AD Import and AD Sync agents have been configured, read Use and Manage the Active Directory Integration (ADI)<\/a> . <\/p>\n\n\n\n
System Requirements<\/h2>\n\n\n\n
- \n
- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n
- \n
- Server Core installation is also supported for Windows Server versions 2016, 2019, and 2022. You will need to include the \/msiexec<\/strong> parameter when running the agent installer<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- 15MB disk space<\/li>\n\n\n\n
- 10MB RAM<\/li>\n<\/ul>\n\n\n\n
Installation Steps Overview<\/h2>\n\n\n\n
The main steps you will take to install and configure AD for bi-directional use are:<\/p>\n\n\n\n
- \n
- Determine on which servers the AD import agents will be installed: member servers or domain controllers (DCs).<\/li>\n\n\n\n
- Complete the prerequisite checklist.<\/li>\n\n\n\n
- Determine the Root User container in AD.<\/li>\n\n\n\n
- Create the JumpCloud ADI Integration Security Group in AD.<\/li>\n\n\n\n
- Create the AD Import Service Account.<\/li>\n\n\n\n
- Create the AD Sync Service Account.<\/li>\n\n\n\n
- Delegate control for the AD Import and AD Sync Service Accounts.<\/li>\n\n\n\n
- Create an AD domain instance in JumpCloud.<\/li>\n\n\n\n
- Select your configuration and download the agents.<\/li>\n\n\n\n
- Run the the AD Import Agent installation wizard.<\/li>\n\n\n\n
- Reboot each AD server where the import agent was installed.<\/li>\n\n\n\n
- Verify the Import Agent Service started.<\/li>\n\n\n\n
- Complete post-installation AD import agent configuration on each DC.<\/li>\n\n\n\n
- Run the AD Sync Agent installation wizard.<\/li>\n\n\n\n
- Verify AD sync and AD import agents in the JumpCloud Admin Portal.<\/li>\n<\/ol>\n\n\n\n
Considerations<\/h2>\n\n\n\n
Agent Version Considerations<\/h3>\n\n\n\n
Import Agent<\/strong><\/p>\n\n\n\n
<\/p><\/div>Important:<\/strong> \nWhen upgrading from AD import agent v2.6.0 or lower, you must select Install New Agent<\/strong> from the Downloads dropdown menu in the ADI Details page to get the connect key, which is required to complete the upgrade of the agent on the AD server.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Import agent v3.0.0 and higher supports delegated user authentication to AD<\/li>\n\n\n\n
- As of import agent v2.2.1, the following changes were made:\n
- \n
- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration.<\/li>\n\n\n\n
- All references to AD Bridge changed to AD Import.<\/li>\n\n\n\n
- The jcimport username & password and the API key are stored in the registry instead of the ADI Import Agent configuration file. Both the password and API key are encrypted and the values in the registry are replaced with the encrypted value when the import agent starts.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Sync Agent<\/strong><\/p>\n\n\n\n
- \n
- As of ADI sync agent version 4.5.1, the following changes were made:\n
- \n
- The default location for all agent related installation, configuration, and log files is C:\\Program Files\\JumpCloud\\AD Integration\\<\/li>\n\n\n\n
- The ADI sync agent can be installed independently of the ADI import agent<\/li>\n\n\n\n
- The ADI sync agent connect key is encrypted and the value in the registry is replaced with the encrypted value when the agent starts<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Delegated Authentication Considerations<\/h3>\n\n\n\n
The delegated authentication functionality is specific to the ADI AD import agent. Review ADI: Use AD Delegated Authentication<\/a> for specific considerations and more information about delegated authentication to AD. <\/p>\n\n\n\n
Warning:<\/strong> \nWhen the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and Pending<\/strong> for the ADI configuration and the user’s Delegated Authority<\/strong> is Active Directory<\/strong>, the user will not be able to log in. An AD import agent, version 3.0 or higher, must be installed and active to change the status of Delegated Password Validation<\/strong> from Pending<\/strong> to Active<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
<\/p><\/div>Important:<\/strong> \nWhen upgrading the AD import agent to version 3.0, existing users connected to the domain will not have their log in delegated to AD unless the Delegated Authority<\/strong> is manually set to Active Directory<\/strong> for those existing users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- The delegated authentication setting, Delegated Password Validation<\/strong>, is disabled by default but can be enabled.<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is enabled and active: \n
- \n
- All users imported from AD to JumpCloud by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When the delegated authentication setting, Delegated Password Validation<\/strong>, is disabled:\n
- \n
- All users imported by import agent v3.0.0 or higher will have their Delegated Authority<\/strong> automatically set to Active Directory<\/strong> and their login to the JumpCloud User Portal and SSO login delegated to AD for validation.<\/li>\n\n\n\n
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegation is enabled for them.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
General Installation Considerations<\/h3>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nAll installed agents should be the same version to avoid unexpected behavior or the potential for users not being able to log in if the primary agent is switched.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
<\/p><\/div>Important:<\/strong> \nYou must reboot the servers after the AD Import Agent installation.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nYou DO NOT need to reboot the servers after the AD Sync Agent installation.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- The AD sync agent does not need to be installed on all servers.<\/li>\n\n\n\n
- Connect Keys are one-time use keys required for installing the agents on a new AD server. They expire<\/strong> in seven days.<\/li>\n\n\n\n
- The AD Domain and Root User container DN must be the same for both the AD import agent and AD sync agent <\/li>\n\n\n\n
- Non-standard ASCII characters are not supported in the Root User DN.<\/li>\n\n\n\n
- When upgrading an agent, the installation wizard prompts for minimal information:\n
- \n
- Directory for where the installation should occur.<\/li>\n\n\n\n
- Finish screen.<\/li>\n\n\n\n
- Upgrading from AD import agent v2.6.0 or lower to v3.0.0 or higher will also prompt for the import agent connect key.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- An ADI integration specific Security Group (e.g., \u201cJumpCloud\u201d) must be configured within the root user container or root OU to import and sync users from AD to JumpCloud:<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
In multi-domain environments, the security group must have a unique name within each domain (e.g., \u201cJumpCloud (mydomain1)\u201d and \u201cJumpCloud (mydomain2)\u201d)<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Demoting a DC installation to a member server and promoting a member server installation to a DC aren\u2019t supported. The agent(s) must be uninstalled first and then installed on the other type of server.<\/li>\n\n\n\n
- A reinstall of the same ADI import agent is treated as an update.<\/li>\n\n\n\n
- When multiple AD agents are installed, one import agent and one sync agent are designated as the primary agent by the ADI service. All create and change requests are sent to that agent. If that agent becomes unavailable, another active agent is automatically designated as the primary. For the import agent, all delegated authentication requests are also sent to the primary agent.<\/li>\n\n\n\n
- When updating an existing agent installation, only minimal installation screens are shown:\n
- \n
- Directory for where the installation should occur<\/li>\n\n\n\n
- Finish screen<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Member Server Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the ADI agents on member servers:<\/p>\n\n\n\n
Import Agent<\/strong><\/p>\n\n\n\n
- \n
- The AD password does<\/strong> NOT<\/strong> sync from AD to JumpCloud. Users imported and synced from AD will not have a password in JumpCloud.<\/li>\n\n\n\n
- A server reboot is required.<\/li>\n<\/ul>\n\n\n\n
Sync Agent<\/strong><\/p>\n\n\n\n
- \n
- If you have member servers in your AD environment, installing the sync agent on member servers is the recommended option.<\/li>\n\n\n\n
- All sync agent functionality works when the agent is installed on member servers.<\/li>\n\n\n\n
- A server reboot is NOT required.<\/li>\n<\/ul>\n\n\n\n
Domain Controller (DC) Installation Considerations<\/h3>\n\n\n\n
The following are considerations only if you choose to install the agents on DCs:<\/p>\n\n\n\n
Import Agent<\/strong><\/p>\n\n\n\n
- \n
- Downtime should be scheduled. The installation requires a server reboot.<\/li>\n\n\n\n
- An import agent must be installed on all<\/em><\/strong> Domain Controllers.<\/li>\n\n\n\n
- AD passwords will<\/strong> sync from AD to JumpCloud. <\/li>\n<\/ul>\n\n\n\n
Sync Agent<\/strong><\/p>\n\n\n\n
- \n
- A sync agent does NOT need to be installed on all<\/em><\/strong> Domain Controllers.<\/li>\n\n\n\n
- Installing the sync agent on more than one DC is recommended for redundancy and high-availability .<\/li>\n\n\n\n
- The installation does not require a server reboot.<\/li>\n\n\n\n
- JumpCloud passwords will<\/strong> sync from JumpCloud to AD.<\/li>\n<\/ul>\n\n\n\n
Security Considerations<\/h3>\n\n\n\n
- \n
- It is STRONGLY<\/strong> recommended to install and use LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users<\/li>\n\n\n\n
- We recommend periodically rotating the passwords for the server accounts used by the integration e.g., jcimport<\/strong> and jcsync<\/strong>) for security reasons.<\/li>\n\n\n\n
- API tokens are specific to each Admin account. Use a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Warning:<\/strong> \n
If the JumpCloud Administrator Account associated with the import is deleted or the API key is rotated, the import will stop working. All imports will fail until a valid API key is generated and updated in the registry on the AD servers.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Password Considerations<\/h3>\n\n\n\n
- \n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n<\/ul>\n\n\n\n
- \n
- Users imported from AD to JumpCloud will have their Password Authority<\/strong> set to None (JumpCloud)<\/strong>. This setting can be changed from Users>More Actions>Set External Password Authority<\/strong> or directly from the User Details page.<\/li>\n<\/ul>\n\n\n\n
- \n
- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud.\n
- \n
- This configuration is used when user passwords are managed in JumpCloud.<\/li>\n\n\n\n
- Users imported from AD will not have their AD password stored on their initial login to JumpCloud nor will the password sync from AD to JumpCloud.<\/li>\n\n\n\n
- Users imported from AD will have<\/li>\n\n\n\n
- When a user’s Password Authority<\/strong> is set to None (JumpCloud)<\/strong> the password can set and managed in JumpCloud.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Warning:<\/strong> \n
Users will not be able to log in to JumpCloud User Portal or SSO apps if JumpCloud AD import agent is installed on member servers<\/strong>, the user’s Password Authority<\/strong> is set to Active Directory<\/strong>, and the user’s Delegated Authority<\/strong> is set to None<\/strong>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
- \n
- When a user’s Password Authority<\/strong> is set to None (JumpCloud)<\/strong><\/strong>:\n
- \n
- Passwords can be managed in AD, JumpCloud, or both.<\/li>\n\n\n\n
- Password expiration notifications are sent from JumpCloud.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When a user’s Password Authority<\/strong> is set to Active Directory<\/strong><\/strong>:\n
- \n
- The password cannot be set or changed password in JumpCloud, with the exception of the link from the password expiration notification.<\/li>\n\n\n\n
- Passwords must be managed in AD.<\/li>\n\n\n\n
- Password expiration notifications are sent from JumpCloud.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
User Sync Considerations<\/h3>\n\n\n\n
- \n
- Synced users must have values for <First Name> and <Last Name>, i.e., the first name and last name fields cannot be empty, otherwise the users will fail to sync.<\/li>\n\n\n\n
- The JumpCloud ADI import and sync agent services use TLS for all communication. If no network connectivity exists to JumpCloud, the ADI won\u2019t work properly <\/li>\n<\/ul>\n\n\n\n
Sync from AD to JumpCloud<\/strong><\/p>\n\n\n\n
- \n
- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory.\n
- \n
- If you relocate users in AD outside of the Root User Container, you could disrupt password synchronization, or remove users and groups from your JumpCloud instance, along with any associated data and resource associations.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- To sync users from AD to JumpCloud, users must be members of the ADI specific Security Group (e.g., \u201cJumpCloud\u201d or “JumpCloud -Domain1”) or of a Security Group nested under this Security Group<\/li>\n\n\n\n
- Users who are imported from AD to JumpCloud will automatically have their Password Authority<\/strong> set to Active Directory<\/strong> by default and the attributes that sync will be read-only in both the Admin Portal and in User Portal. These fields become restrictedFields.<\/li>\n\n\n\n
- You can manage users in 2 ways:\n
- \n
- Individually by adding them to the security group created for this integration, located in the designated OU <\/li>\n\n\n\n
- Using groups located in or nested in the designated Root user container by adding those groups as a member of the JumpCloud Integration Security Group<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- ADI Import Agent settings in the jcadimportagent.config.json<\/strong> file control the behaviors that occur in JumpCloud when certain actions are taken on the user in AD\n
- \n
- Removing users from the JumpCloud integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Removing users from the JumpCloud Integration Security Group within AD will either delete those users in JumpCloud and deprovision them from all bound resources or disconnect them from the AD integration, leaving them active in JumpCloud and allowing them to be managed in JumpCloud directly. The behavior is controlled by the UserDissociationAction setting in AD Import Agent configuration file <\/li>\n\n\n\n
- Importing privileged user accounts<\/a>, such as Domain Admins and accounts with \u201cadminCount=1\u201d, into JumpCloud from AD, isn\u2019t supported. <\/li>\n\n\n\n
- The Password Authority<\/strong> setting can be changed for a specific user from their user record directly or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>. <\/li>\n\n\n\n
- <\/li>\n<\/ul>\n\n\n\n
Export and sync from JumpCloud to AD<\/strong><\/p>\n\n\n\n
- \n
- Users created in AD from JumpCloud are created in the AD root container. <\/li>\n<\/ul>\n\n\n\n
Regular<\/strong><\/p>\n\n\n\n
Migrating device accounts from AD Managed to JumpCloud Managed<\/h3>\n\n\n\n
- \n
- JumpCloud has a tool, called the ADMU<\/a>, which is used to migrate end-user Windows computers from AD to JumpCloud<\/li>\n<\/ul>\n\n\n\n
Attributes<\/h2>\n\n\n\n
The user attributes that sync from AD to JumpCloud and JumpCloud to AD are:<\/p>\n\n\n\n
- \n
- First Name<\/li>\n\n\n\n
- Last Name<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Email<\/li>\n<\/ul>\n\n\n\n
If the\u00a0SyncAdditionalAttributes<\/strong>\u00a0setting is\u00a0true<\/kbd>\u00a0in the\u00a0jcadimportagent.config.json<\/kbd>\u00a0file, the following attributes are also synced from AD to JumpCloud:<\/p>\n\n\n\n
- \n
- displayname<\/li>\n\n\n\n
- description<\/li>\n\n\n\n
- JobTitle<\/li>\n\n\n\n
- department<\/li>\n\n\n\n
- company<\/li>\n\n\n\n
- location<\/li>\n\n\n\n
- employeeType<\/li>\n\n\n\n
- phoneNumbers<\/li>\n\n\n\n
- addresses<\/li>\n\n\n\n
- manager\u00a0<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
These attributes become read-only (restrictedFields) in JumpCloud when a user’s Password Authority<\/strong> is set to Active Directory<\/strong>. The Password Authority<\/strong> setting can be changed for a specific user directly from their User Details page or for multiple users from Users<\/strong> >More Actions<\/strong>>Set External Password Authority<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prerequisite Checklist<\/strong><\/h2>\n\n\n\n
Before installing the AD import and AD sync agents, we recommend completing each of the following checklist items before continuing.<\/p>\n\n\n\n
- \n
- Know your AD Domain Admin credentials.<\/li>\n\n\n\n
- Decide whether you want to install the sync agents on your AD domain\u2019s non-DC Domain Member Servers (member servers) or Domain Controllers (DCs).\n
- \n
- When installing the import agent on DCs<\/strong>, schedule downtime. <\/strong>Installation requires server reboot! <\/li>\n\n\n\n
- If installing the AD sync agent on DCs<\/strong>, we recommend that you install the AD Sync agent on your Primary DC and any DC impacted by extended replication delays.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Verify you have access to all<\/em> DCs or member servers in the AD domain.<\/li>\n\n\n\n
- Ensure your DCs or member servers are running on a JumpCloud supported 64-bit Windows Server version (2012, 2016, 2019, 2022).<\/li>\n\n\n\n
- Verify DCs or member servers have networking access to the internet and are able to communicate outbound to console.jumpcoud.com<\/strong> over HTTPS port 443. <\/li>\n\n\n\n
- Create a dedicated Administrator account<\/a> in JumpCloud that is specifically for the ADI.<\/li>\n<\/ol>\n\n\n\n<\/p><\/div>Important:<\/strong> \n
API tokens are specific to each Admin account. Create a separate, dedicated account for this integration to prevent the possibility of breaking the ADI connectivity to your JumpCloud organization when an Admin account is deleted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Generate and securely store the API key<\/a> for the ADI dedicated Administration account.<\/li>\n\n\n\n
- Verify all users to be synced from AD to JumpCloud and JumpCloud to AD have a value for first name and last name.<\/li>\n\n\n\n
- Align password complexity requirements between AD and JumpCloud as closely as possible. Otherwise, passwords may not replicate if they\u2019re rejected by the destination directory\u2019s complexity requirements.<\/li>\n\n\n\n
- (Recommended<\/strong>) Verify all users you plan to import into JumpCloud live in a single OU or are nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory. <\/li>\n\n\n\n
- Review Advanced Configurations for the Active Directory Import Agent<\/a> to understand the configuration settings available for the import agent and note any default values that need to be changed as part of the installation.<\/li>\n\n\n\n
- (Strongly recommended<\/strong>) Install LDAPS.<\/li>\n<\/ol>\n\n\n\n<\/p><\/div>Important:<\/strong> \n
We strongly<\/strong> recommend installing and using LDAPS<\/a> for the ADI. Configuring and using LDAPS on the Domain Controller that the Jumpcloud ADI agents will connect to secures any sensitive information that is exchanged between the Jumpcloud agents and the Domain Controller and protects against malicious users.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Prepare AD for the Agent Installations<\/h2>\n\n\n\n
Determine Root User Container<\/h4>\n\n\n\n
Prepare for the agent installations in AD by determining the Root User Container.<\/p>\n\n\n\n
<\/p><\/div>Important:<\/strong> \nThe AD Domain and Root User container DN needs to be the same for both the AD import agent and AD sync agent.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
AD Import Agent<\/h4>\n\n\n\n
The JumpCloud AD Import agent is designed to integrate with AD\u2019s default \u2018Users\u2019 container (CN=Users) which is pre-populated in the AD Users and Computers (ADUC) interface and labeled as \u201cUsers\u201d as shown in the following image. (This is a default domain with no custom containers. In this use-case the Root Container is CN=Users;DC=example;DC=com). <\/p>\n\n\n\n
- JumpCloud has a tool, called the ADMU<\/a>, which is used to migrate end-user Windows computers from AD to JumpCloud<\/li>\n<\/ul>\n\n\n\n
- Users created in AD from JumpCloud are created in the AD root container. <\/li>\n<\/ul>\n\n\n\n
- We recommend that all users you plan to import from AD into JumpCloud live in a single OU or be nested underneath a chosen OU (Root user container) in AD. This can be the default CN=Users container in AD or an alternate custom OU in the directory.\n
- When a user’s Password Authority<\/strong> is set to None (JumpCloud)<\/strong><\/strong>:\n
- When the JumpCloud AD import agent is installed on all DCs<\/strong>, the AD password does<\/strong> sync from AD to JumpCloud. This means that the password will be saved in both AD and JumpCloud. \n
- When the JumpCloud AD import agent is installed on member servers<\/strong>, the AD password does NOT <\/strong>sync to JumpCloud.\n
- Users imported from AD to JumpCloud will have their Password Authority<\/strong> set to None (JumpCloud)<\/strong>. This setting can be changed from Users>More Actions>Set External Password Authority<\/strong> or directly from the User Details page.<\/li>\n<\/ul>\n\n\n\n
- Password complexity requirements in AD and JumpCloud should be as closely aligned as possible to avoid passwords being rejected and failing to sync due to not meeting the complexity requirements.<\/li>\n<\/ul>\n\n\n\n
- As of ADI sync agent version 4.5.1, the following changes were made:\n
- 64-bit Windows Server (versions 2012, 2016, 2019, 2022)\n