AD Connect Old Server

Question

Hi There,

We have an Old Active Directory server that has AD connect on it. We no longer require an ADFS Service and looking to move to Password Hash Sync login instead of Federation.
We have built a new server (New AD Server) and we are wanting to move AD Connect to it.

I think the question I'm wanting to ask is do I move to PHS on the old server first?

before I export details from AD Connect and Import it to the new AD Connect on the new AD server?

Any help would be appreciated

Answer 1

@Aorangi Vaia , Apologies for the delayed reply . I understand that you are trying to decommission ADFS service and move to Password Hash Sync completely. Ideally from a deployment perspective you should enable the Password Hash Sync on the old AD connect server first . This way, when you export the settings you wont need to deal with any cleanup on the new AD connect server.

Once this is done , you should update the domains in your tenant from Federated to Managed. You should use the following commands and run the same on AD FS server . This will delete the replying party connector for Office365/AzureAD on AD FS server. You can keep the AD FS running if you have applications using legacy authentication . However since the Office 365 relying party connector is removed , any authentication to Microsoft Azure cloud/Office 365 services/azureAD will be directly through the cloud.

• Install Azure AD PowerShell Module.
• Login to Powershell module using Azure AD global Administrator.
• Run the cmdlet for each domain.
  • Set-MsolDomainAuthentication -Authentication Managed -DomainName <domain name>
• Check the instructions here.

You can do the migration of users from federated auth to cloud authentication only using staged rollout which means using a small set of users to experience the cloud authentication using Password hash sync rather than all at once . Please review the complete guide to migrate from federation to cloud authentication .

Hope the information is helpful and clarifies your doubts. If the information in the post is helpful , please do accept the post as answer which can help other members in the community with similar queries. I have linked some articles and I would suggest to go through them which will help you in a better way . Should you still have any queries , please let us know and we will be happy to help .

Thank you.

----------------------------------------------------------------------------------------------------------------------------------------------------------

• Please don't forget to click on whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators