AD Sync

AD Sync

AD Sync lets K12Panel read Microsoft Active Directory user login profile names and map them to existing People. Mapping is done by matching email addresses on AD user profiles to People with the same email. A PowerShell script, run on a schedule on a domain controller, performs the sync.

This allows Windows logins to be tracked using AD identities (rather than Google Credential Provider for Windows) on computer assets. You can set up multiple AD Syncs from multiple domain controllers for redundancy or to cover different domains in a forest.

Prerequisite: Cloud Sync must be configured first to populate Panel with the OU structure and People — AD Sync only maps login profile names onto People that already exist.

Add an AD Sync

• Click Add AD Sync Settings.
• For the domain name, enter the simple name without an extension — for company.com, enter company.
• Enter the external (public) IP the sync will originate from; syncs from other IPs are rejected to resist spoofing.
• After saving, open Show Details to find your AD Sync key (needed below) and the sync report summary.

Domain Controller Script

• With the correct organization selected, download the PowerShell script from Settings → Software Downloads. (Script versions are org-specific, so confirm the right org is selected.)
• Place the script in an administrative location on the domain controller where ordinary users can’t access or modify it.
• Get your Org ID (Settings → Organization Overview) and your AD Sync key (the AD Sync tab) before continuing.

Scheduled Task

Create a task in Task Scheduler with these settings:

• Name: “Panel - AD Sync”.
• Enable “Run whether user is logged on or not” and “Run with highest privileges.”
• Trigger: Daily, repeating every 1 hour.
• Optionally enable “Stop task if it runs longer than 1 day” to kill frozen processes.
• Program: powershell
• Arguments: -NoProfile -ExecutionPolicy Bypass -NonInteractive -Command “& 'path\to\script' 'ORG GUID' 'AD SYNC GUID'”

Watch the quoting carefully: single quotes around the ORG GUID and AD SYNC GUID, and the double quotes right after -Command and at the very end. This is easy to miss. Adjust task conditions for your environment, then run the task once to trigger it immediately.

Common Questions

Does AD Sync create People?
No. It maps login profile names onto existing People. Configure Cloud Sync first to import People and OUs.

How are AD users matched to People?
By email address.

Can I run AD Sync from more than one domain controller?
Yes — for redundancy or to cover multiple domains in a forest.

Why was my sync rejected?
It came from an IP other than the external IP you registered. This guards against spoofing.

My scheduled task fails — what’s the usual cause?
Quoting in the arguments. Check the single quotes around the GUIDs and the double quotes around the -Command value.