Does EOP for in house accounts require Active Directory Sync?

Is it just me, or is the documentation on Office 365 filled with contradictions and not written in a way that's understandable, even for seasoned IT pros?
In short, does EOP require Active Directory to use non cloud accounts?
I'm having a problem with spam on a NON Active Directory integrated mail server.  Nowhere in any online documentation that I found (about 10 hours of googling) says that AD is required to implement EOP.
 To the contrary:
See here: http://technet.microsoft.com/en-us/library/jj871669(v=exchg.150).aspx
Q. Does the service work with legacy Exchange versions (such as Exchange Server 2010) and non-Exchange environments?
A. Yes, the service is server agnostic and can be used with any SMTP mail transfer agent.
But when I attempt to use EOP with my office 365 accounts, with local email (not exchange online), my mail is bounced because the accounts aren't found.  If I create exchange accounts, mail doesn't come to my local server, it stays at exchange online.
Am I missing something?

Hi,
changing the domain type to Relay disables the edge blocking feature where e-mails to invalid users are blocked by EOP. In my eyes this is a very important feature so you should use one of the following ways to have the valid recipients in EOP:
http://technet.microsoft.com/en-us/library/dn636911(v=exchg.150).aspx
Greetings
Christian
Christian Groebner MVP Forefront

Similar Messages

  • Exchange and EOP and "Windows Azure Active Directory Sync tool".

    Hi,
    Since we are using our on-premises Exchange server and Microsoft EOP only for spam filter, and
    we are not using the EOP created domain "XXXX.onmicrosoft.com" for anything.
    Technically speaking, do we require
    "Windows Azure Active Directory Sync tool" to be installed and synchronizing all our AD to the EOP!
    Thanks,

    The Windows Azure Active Directory Sync Tool allows you to filter mail in EOP for nonexistent recipients.  This is a pretty useful antispam feature that you'll be forgoing if you choose not to deploy the tool.
    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

  • Create a User account in active directory from SharePoint online 2013 list data

    Hello,
    I am trying to create a SharePoint list through which i can create a user account into active directory, 
    1 - HR is sending the detail in the email body to a Specific email address  ([email protected]) like below..
    First Name: XYZ
    Last Name: ABC
    Address: ABC 123
    Designation: Analyst
    Employee ID: 10492
    and so on 
    2 - I need to pickup every new email data of the above section into sharepoint list (in Column)
    First Name        Last Name       Address         Designation   Employee ID   
    3 - I want to create a event receiver through which i can go ahead and find the new data in the list and then create a user in the active directory,
    I tried very hard and since i dont have much experience in coding part,  any help will be highly appreciated
    Thank you 
    Aman 

    1- Configure Incoming Email Setting at your SharePoint Farm -
    https://technet.microsoft.com/en-us/library/cc262947.aspx
    http://blogs.technet.com/b/harmeetw/archive/2012/12/29/sharepoint-2013-configure-incoming-emails-with-exchange-server-2013.aspx
    2- Configure your Sharepoint List Incoming e-mail settings for [email protected] - ListSetting-Communications->Incoming e-mail settings. -
    https://support.office.com/en-in/article/Enable-and-configure-e-mail-support-for-a-list-or-library-dcaf44a0-1d9b-451a-84c7-6c52e7db908e
    3- Write an Incoming Email Receiver , and Add you Email Body Parsing Code (retrive value of fields , firstname , lastname etc) in
    EmailReceived() method. also add the code for adding new user in Active Directory
    http://blogs.msdn.com/b/tejasr/archive/2010/03/06/event-handler-code-to-add-incoming-emails-with-subject-discussion-id-as-replies.aspx
    https://pholpar.wordpress.com/2010/01/13/creating-a-simple-email-receiver-for-a-document-library/
    4-  Active Directory Code Help -
    http://www.codeproject.com/Articles/18102/Howto-Almost-Everything-In-Active-Directory-via-C
    http://www.codeproject.com/Tips/534718/Add-User-to-Active-Directory
    Thanks
    Ganesh Jat [My Blog |
    LinkedIn | Twitter ]
    Please click 'Mark As Answer' if a post solves your problem or 'Vote As Helpful' if it was useful.

  • Could not connect to the Active Directory. Active Directory Certificate Services will retry when processing requires Active Directory access

    Event properties – Event 91, Level Error, Event ID 91, Date and time 5/10/2012 11:29:48AM, Service CertificationAuthority
    General: 
    Could not connect to the Active Directory.
    Active Directory Certificate Services will retry when processing requires Active Directory access.
    We have a Windows 2008 Server Enterprise with AD . I would like to enable the service  "Certificate Services"  that
    allow me to enable radius to authenticate users wireless with the active directory.

    Hi, 
    Can you please check this forum or someone from Microsoft, as we have post here dating back from October that are not being answered.
    Everything for us is exactly the same as szucsati and Racom
    NMNM, 
    Please give us an answer on this as the link provided is absolutely useless.
    Thank you.

  • How to transfer user accounts from Active Directory to Open Directory

    Please help me , want to tranfer user accounts from Active Directory (Windows server 2012 ) to Open Directory (OS X server 10..2.9)

    Hi,
    Go to the advanced administration for the OSX Server:
    https://help.apple.com/advancedserveradmin/mac/3.1/#apd6D7FE39D-32AA-400C-91E1-5 0ABC15655C8
    This pretty easy way of connecting your server to the Windows server should give AD users access to OD services. That will be a good start.
    Read up on this as well:
    http://support.apple.com/kb/PH15469
    Do you want to import them all or just the Mac users?
    Goodluck!
    Jeffrey

  • Use principal name for email if blank in Active Directory

    Hi all,
    allthough I set "Use principal name for email if blank in Active Directory", Spiceworks asks me for an emailadress when i want to Login to the Portal with an AD user without emailadress.
    This topic first appeared in the Spiceworks Community

    Hi,
    What if we change the user name of user account, will it have impact on roaming profiles.
    Yes, it will affect roaming profiles. Please rename the roaming profile folder as the new user account name, in addition, change the profile path in ADUC.
    Here is an related article below for you:
    How to Rename a Windows 7 User Account and Related Profile Folder
    http://social.technet.microsoft.com/wiki/contents/articles/19834.how-to-rename-a-windows-7-user-account-and-related-profile-folder.aspx
    Best Regards,
    Amy

  • Disable user account on Active Directory??

    I sync user account from iPlanet DS to Active Directory through Meta Directory. If I disable user account on iPlanet DS, can meta directory disable the user account on Active Directory Server?

    AD has an attribute called userAccountControl. This attribute has a value of 512 when an AD account is active and 546 when it has been disabled. I flow a constructed attribute called userAccountControl with two rules, one for enable and one for disable. The selection criteria for the enable/disable rule is based upon a change in employee status. For example, (%mv.employeestatus%==T). Another way to do this would be a single attribute constructrion rule that calls an external script (written in Perl) that accounts for multiple conditions and then enables/disables the AD account accordingly. In the attribute flow rule, you flow the constructed attribute userAccountControl to mdsAdUserAccountControl (assuming an AD-Specific schema setting in the AD connector).

  • Could we have same name's for User and Groups in Active directory

    When iam trying to create a user name " Logistics " under a OU, I am getting a error
    "The pre-windows 2000 logon name you have chosen is already in use in this domain. Choose  aother pre-windows logon name, and then try again"
    We already have a group by the name " Logistics "
    Could we have same name's for User and Groups in Active directory?
    Thanks in Advance

    sAMaccountName attribute is unique. So, the short answer is you cannot.
    This posting is provided AS IS with no warranties or guarantees , and confers no rights.
    Ahmed MALEK
    My Website Link
    My Linkedin Profile
    My MVP Profile

  • Cannot install Windows Azure Active Directory Sync tool on Server 2012 w/ SQL Server 2012

    I went to change a user password on the server today and after changing the password I logged into the SQL server to run “Import-module dirsync” & “Start-onlinecoexistencesync” in powershell in order to sync the new password with Exchange Online. After
    waiting ten minutes I tried setting up the email on the user’s PC but the new password was not being accepted. I logged into Office 365 and I got the following warning.
    "Warning: Last synced more than 3 days ago | Troubleshoot"
    So I pressed troubleshoot and the site installed a tool on the server to try and find out what the issue was. After the tool ran it told me that the version of dirsync.exe was out of date and that I should download the new one and install it. So I downloaded
    the new dirsync.exe (version 7020 I believe) and tried installing it. I kept getting error after error, different ones to boot.
    First it told me I wasn’t part of the FIMSyncAdmins group (so I added myself), then it told me that it could not connect to MIIS server,  so I tried starting it and windows said that there was a problem with the sign on used by the service so I had
    to reset the password for the local user named “AAD_bfd1d6f0cef7” which was being used by that service. The service started successfully and when I went to install it told me I could not and if the problem persisted I should uninstall the old version and reinstall.
    Looking in the log file, before I even install the software I see the following Information...
    Level: Information
    Date: 2015-03-24 12:49:17 PM
    Source: Directory Synchronization
    Event ID: 0
    Task Category: None
    "The current configuration of the Windows Azure Active Directory Sync tool is invalid. Please reinstall the Windows Azure Active Directory Sync tool."
    So I tried to reinstall (i even manually uninstalled the old version and removed the folder in C:\Program Files\ called "Windows Azure Active Directory Sync") and on reinstall I get as far as "Installing Components" and then after a little
    while it errors out with the error "The install was unable to setup a required component. Check the event logs for more information. Please try the installation again and if the error persists, contact Technical Support. "
    Looking at the log file there are a bunch of new entries, created by the installer. There's over 300 new entries and I can not post them all here due to character count restriction. you can find the log file here...
    www.clarkfreightways.com/wp-content/uploads/2015/03/dirsync_log.txt
    Can anyone tell me what is going on, I've been looking through the log files and I can see errors but I'm not sure what to do to fix it.

    Greetings!
    Wanted to know if you've hosted the DirSync tool (latest version) on a VM? Also, if this is deployed in a Production or Lab environment? If it's a lab setup, you may
    try installing the DirSync on a new VM / Server (suspecting that it could be some machine related issues).
    Here's a Support KB helping with different errors:
    http://support.microsoft.com/en-us/kb/2684395
    If its a production environment, would suggest to raise a
    Technical Support Ticket for assisting further with break-fix.
    Thank you,
    Arvind 

  • Windows Azure Active Directory Sync Setup

    Hi,
    Currently trying to install Windows Azure Active Directory Sync tool for use with Office 365.
    After five attempts to install the Sync Tool, I finally had some luck, now I am configuring the Sync tool and have been given the following error "A constraint violation occurred"
    In looking at the event logs this is the information I get:
    System.Management.Automation.CmdletInvocationException: A constraint violation occurred. ---> System.DirectoryServices.DirectoryServicesCOMException: A constraint violation occurred. at System.DirectoryServices.DirectoryEntry.CommitChanges() at Microsoft.Online.DirSync.Common.DirectoryServicesAdapter.DirectoryEntry.CommitChanges()
    at Microsoft.Online.Coexistence.PS.Config.EnableMSOnlineRichCoexistence.GrantWritePropertyPermission(SecurityIdentifier securityIdentifier, String groupDn) at Microsoft.Online.Coexistence.PS.Config.MSOnlineRichCoexistenceBase.GrantPermission(Action`2 grantPermissionAction)
    at Microsoft.Online.Coexistence.PS.Config.EnableMSOnlineRichCoexistence.InternalBeginProcessing() at Microsoft.Online.Coexistence.PS.Config.MSOnlineConfigCmdlet.BeginProcessing() at System.Management.Automation.Cmdlet.DoBeginProcessing() at System.Management.Automation.CommandProcessorBase.DoBegin()
    --- End of inner exception stack trace --- at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input) at Microsoft.Online.DirSync.PowerShellAdapter.PowerShellCommand.ExecuteCommand(Command command, Boolean refreshPath)
    Suggestions?
    Thanks

    Hi,
    According to your description, it seems that you have installed Azure Active Directory Sync tool successfully, right? What configuration have you done when you got that error message?
    Firstly, I recommend you to check the event logs for more detailed information about this issue.
    In general, it is recommended to install the Directory Sync tool on a member server rather than a Domain Controller. If you installed Azure Active Directory Sync Tool on a Domain Controller, please uncheck “Start Configuration Wizard now”
    checkbox and then log off and log in again to configure the Azure Active Directory Sync Tool Configuration Wizard. If you forget to follow the above process, the Configuration Wizard will return an error "Constraint Violation Error".
    Besides, please also check the permission of the system account. You can add it into the built-in Administrators group in your on-premise domain to see if the issue persists.
    More information:
    HowTo: Install the Windows Azure Active Directory Sync Tool
    Best regards,
    Susie

  • Connect Active Directory Sync Error - operation-size-error

    We are on Connect 9. We have our Active Directory Sync running once per day. I received a sync log error as follows:
    E-Learning-All-Empl-grps
    G
    error
    Change$Update$Group: SyncTargetException: StatusException$OperationSizeError: <status code="operation-size-error"/>
    The E-Learning-All-Empl-grps is a distribution list in Active Driectory that is used to contain one of 9 sublists. Each sub-list has up to 800 names. This was to get around an earlier issue with their being a limitation when we are on Breeze that only a max of 800 names could be in any group.
    What does this error mean and how can I correct this?
    Dave

    I tried all of this, I still can not bind my Mac 10.6.3 to Microsoft Windows 2003 R2 Active Directory, and the failure I receive that Time settings between both computers is not synced although the time is the same on both machines, and I restart the NNTP on Windows Server, and added the Active Directory IP Address on the Date & time Settings on Mac.
    Any Help

  • Joining 10.8.5 with existing account to Active Directory domain

    Hi-
    I have a MacBook Pro that I am using as a test computer to figure out how to introduce the growing population of Mac's into our Active Directory environment in our small company. This comptuer is running OSX 10.8.5
    There is a test account in AD that I will be using to connect to the windows domain. I am able to get the Laptop binded to AD, and have no problem authenticating, and seeing all the network resources required.
    Here is the part that has me stumped:
    Is there any way to take my existing "local" account that was configured when I began using my MBP without Active Directory and continue to use it, but logon to the laptop using my Active Directory account?
    Perhaps copy all the settings and preferences from the local account ontop of the AD account on the laptop?
    I have been using this laptop as my personal machine for many months and have quite a few customizations made to my deskop preferences, icon layouts, etc. This will be same case with all of the users that will soon be authenticating on the domain. We need this for centralized management of network shares, password policies, and number of other security features.
    There is some limited information on the web, but nothing that I have tried really works, here's some of what i found and the difficulty that resulted.
    http://community.spiceworks.com/how_to/show/37886-convert-mac-local-user-into-ac tive-directory-network-user
    - The script mentioned in step 3 was not able to copy local account to the destination folder.
    http://robotcloud.screenstepslive.com/s/2459/m/5322/l/112415-convert-local-accou nts-to-network-mobile-accounts
    - The sudo mv /Users/USERNAME /Users/DIRUSERNAME command was not able to make the "DIRUSERNAME" directory, and did not have any effect if this directory already existed due to a prior logon.
    I'm just looking for some help making it so that my users can retain their desktop layouts that they are used to, but logon to the domain using AD credentials.
    Seems simple, but is pretty difficult to get done.
    Thanks in advance for any help....
    -Aaron

    This might help:
    http://www.afp548.com/article.php?story=20060517222656622&query=radius

  • Convert Open Directory mobile accounts to Active Directory mobile accounts

    We have 200 or so Macs using OD mobile accounts.
    Implementing Active Directory, getting rid of Open Directory.
    How do I change the mobile accounts from OD accounts to AD accounts so that it authenticates against the AD Domain Controller and thus change compter login password when it's changed in AD?
    I can convert accounts this way:
    a.    Delete users’ user account in User preferences pane of System Preferences, but choose to not change the home directory.
    b.    Log into users’ account by choosing the other option, thus creating a mobile account.
    c.    Log out, log into admin account, delete the newly created home directory, rename the home directory from the deleted users account to match the name of the deleted home directory and do a chown –R on the directory for that user.
    Obviously doing above 200x times is tedious and I'd like to avoid this if possible!
    Any other ideas?  Preferably a script I can deploy to all computers?

    I am also testing Leopard in my Active Directory domain and here is what I have found so far. The wireless networks in Leopard seem to be a combination of Panther and Tiger. Each 'Location' that you set has its own list of preferred networks. I have one location for when I am locally on the domain network and others for my bench network and all others under 'Automatic'. The one problem with what you are talking about is that if people change locations and forget to change it back before they log in, it will not find the network, however, adding the other networks all in one location is fine as long as the AD network is on top. You also have to wait about 20 - 30 seconds after you reach the login prompt before proceeding or it will log in without being connected and the AD resources will not be available. I am also finding that Panther knew when it was not on the AD network and did not give any errors, however Leopard squawks when I log in on a different network.
    Cheers,
    Rob

  • Oracle 8.1.7 for Unix and Windows 2000 Active Directory

    Is it possible to integrate the users and passwords of an Oracle Database running on Solaris with the users and passwords defined in a Windows 2000 Active Directory? What are the requirements and the necesary steps?
    I've read the documentation and it shows how to do it if you install Oracle in a Windows 2000 Server, but it does not mention about installing it in any kind of Unix.

    You should consider to base your firm security and central user repository on REALLY SECURE and ROBUST product technology. Not on Windows 2000 Active Directory. Win2K AD is known to be slow and insecure. If you have Oracle on Solaris your data is secure and next step is to move user accounts to real user repository. It may be one of well-known LDAP servers. Try to read some materials on CERT Coordination Center (http://www.cert.org) which describe LDAP servers. After this you can choose the server which best suite your needs.

  • Disabling computer account in Active Directory will still allows the workstation to login

    I have a special scenario. A Widows 7 workstation was in lock mode (waiting for CTRL+ALT+DEL). As an administrator, I disabled the computer account, user account and even reset the password for that user and the workstation. My requirement
    is that the user can not login to the workstation again.
    However, the user able to login to the workstation.
    What AD registry parameter could lock down the computer completely? or is there any parameter in GPO that could lock down the computer?
    Thanks in advance.
    Pingala
    SP

    Hello Karen,
    I am testing with the DOMAIN Account, not local account. With your instructions,
    Control Panel\All Control Panel Items\User Accounts\Manage your credentials
    Select the corresponding credential and click Remove.
    I am able to see local accounts and not the DOMAIN account locally cached.
    BTW, I am not seeing "Manage your credentials", instead, I am seeing "Manage Your Accounts" in User Accounts.
    Secondly, I am looking for a setup with AD GPO so that,  for most of the Enterprise Windows 7 workstations, I would like to apply the policy across the board - "Once a workstation is disabled by the administrator, the domain
    user for that workstation can not login again - especially when the workstation is in lock mode.
    The article you cited did not give any technical details that could help me to clean both local and domain credential caching.
    Please help me with the steps how I can disable the caching for local and domain credentials on the workstation to check this manually first.
    Eventually, I would like to disable a "computer" in Active Directory that should lockdown the targeted workstation for further use. Or let me know what steps are needed to lockdown a workstation immediately when a user is fired before further
    damage occurs to the enterprise resources.
    Thanks,
    Pingala
    SP

Maybe you are looking for