High level description of why an Enterprise Admin account is required for DirSync config

Hi all,
I understand that as part of the Azure AD Sync tool config wizard you are required to enter the credentials of an Enterprise Admin account. These credentials are required for the creation of the MSOL_AD_Sync service account within the Users OU of Active
Directory. This account is granted read and synchronization permissions to the local Active Directory.
Is someone able to provide a high-level description of what this actually means i.e exactly which permissions are granted and on which objects. Are we talking about having to modify the permissions of every single object within Active Directory?
Many thanks in advance,
Graham

Hi,
To start with, I guess you would know that this is a Kind of a Temporary.
I have some details from previous conversations and blogs
Hope this puts some light on your query.
When configuring the Microsoft Online Services Directory Synchronization Tool, you are asked to provide the credentials for an account that has
Enterprise Admin permissions on your organization's local Active Directory directory service. It accepts credentials in either of the following forms:
[email protected]
Example\someone
These Enterprise Administrator credentials are not saved. They are erased from the computer's memory after the service account is created.
How the Active Directory Credentials Are Used
The Microsoft Online Services Directory Synchronization Tool Configuration Wizard uses the Enterprise Admin credentials to create the directory
synchronization service account, MSOL_AD_Sync. This service account is created as a domain account with directory replication permissions on your local Active Directory and with a randomly generated complex password that never expires.
Note:
Changing the password associated with the service account is not recommended.
How the Service Account Is Used
When the directory synchronization service runs, it uses the service account credentials to read from your local Active Directory and write to the
synchronization database. The contents of the synchronization database are written to Microsoft Online Services using the Microsoft Online Services credentials requested on the
Microsoft Online Services Credentialspage of the Microsoft Online Services Directory
Synchronization Tool Configuration Wizard.
Note:
If you add a domain to your Active Directory forest, you must run the Microsoft Online Services Directory Synchronization Tool Configuration Wizard
again to add the new domain to the list of domains to be synchronized.
Thanks & Regards
John Chris

Similar Messages

Why is my admin account log in disappearing after restart?

I have one admin, one standard and a guest account in my MacBook Pro, Mac OS Mavericks. When I restart or turn off and back on, I don't see my primary admin account log in. I only see the standard account and a guest account. All I can do now is log in through the standart accoung and change the account through the menu bar. It does not happen until I log off or restart. Can anyone help?

It sounds like you activated FileVault and only enabled the standard account to unlock the startup volume.
To enable other local users to unlock the volume at startup, see the heading
Letting other users unlock the drive
in this support article. Note that the Enable Users... button only appears if there is at least one user left to enable. There's an illustrated set of instructions here.

Printer Prints fine for Admin Account, but not for "Regular" User Account.

Printer works perfectly when signed on as Administrator, but not when we use non-admin login. I can see the printer - it says ready, but it won't print.. although job does not sit in printer queue.
I did a full driver install FROM the local account, using "Run as" - but it can't find the printer. I did a Full Driver Install from the Admin account, with no change to the non- admin account. Any help would be most appreciated.
Thanks .

Hi @maggie-o,
I understand you can print when printing form an admin account, but otherwise can not. I would be happy to help you with this.
If you are running Norton Antivirus, go into the Control Panel and click on Printers & Faxes, then right click on the Printer and select Properties. In the Properties, click on the Advanced tab., and set it to Print Direct to Printer instead of using the Print Spooler. I think there is something in Norton that prevents the Limited Users account from accessing the Print Spooler.
If the issue persists, please take a look at the following articles: Security permissions for printing, & To set or remove permissions for a printer.
I hope this helps.
Please click the Thumbs up icon below to thank me for responding.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Please click “Accept as Solution” if you feel my post solved your issue, it will help others find the solution.
Sunshyn2005 - I work on behalf of HP

Why is Quicktime 7.0.4 required for iLife '06?

Is it required? If not, what advantages does 7.0.4 have over 7.0.3?

The applications won't launch unless QT 7.0.4 has been installed.
It will just ask you to update your QT if you have 7.0.3 or less.
Verified.

Why is 7.2 the min required for Music Purchases Now - and in 10.2.8?

All versions of iTunes above 6.0.5 are for later operating systems (10.3+) I have 10.2.8 and have not upgraded to any of the 7.0 versions because of the OS and video/TV features which I cannot use. Today, I tried to purchase music and it said minimum of 7.2 was required, but there is NO 7.2 version in the main downloads list at all, and certainly nothing compatible with 10.2.8 (except the older 6.0.5). Of course, this means that 7.5 is out of the question entirely.
What is going on? Should I make new music purchases using a different service entirely now? Is this a music store bug that Apple is in the process of correcting for its other customers?

Apple always only has the newest version available on their site. You can download older versions, including 7.2, here: http://www.oldapps.com/downloadiTunesmac.php

High Level Recommendations For Multi-Tier Application

Hello:
I have been reviewing Windows Azure documentation and I'm still somewhat confused/unsure regarding which configuration and set of services is best for my organization. I will start off by giving a high level description of the what the environment
should be.
A) 2 "Front End" IIS Instances, Load Balanced running an MVC 4.0/.Net 4.5 Web Application
B) A "dedicated" SQL SERVER 2008 R2 server with medium-high resources (ample RAM and processing power)
C) An application server which hosts a Windows Service. This service will require access to the SQL Server listed in B. In addition the IIS "Front Ends" listed in A should have access to a "shared" folder or directory where files
can be dropped and processed by this windows service.
I have looked at Azure Web Site, Azure Virtual Machines and Cloud Services and I'm not sure what is best for our situation. If we went with Azure Web Sites, do we need TWO virtual machines, or a single virtual which can "scale out" up to
6 instances. We would get a Standard Web Site, and the documentation I see says it can scale out to 6 instances. I'm somewhat confused regarding the difference between a "Virtual Machine" and an "Instance". In addition, does
Azure Web Sites come with built in load balancing between instances, virtual machines? both? Or is it better to go with Azure Virtual Machines and host the IIS Front end there? I'm just looking for a brief description/advise as to which would be
better.
Regarding the SQL Server database, is there a benefit to using Azure SQL Database? Or should we go with a virtual machine with SQL Server installed as the primary template? We have an existing SQL Server database and initially we would like to move
up our existing schema to the Cloud. We are looking for decent processing power for the database and RAM.
Finally the "application" tier, which requires a Windows Service. Is an Azure Virtual Machine the best route to take? If so, can an Azure Web Site (given that is the best setup for our needs) write to a shared folder/drive on a secondary virtual
machine. Basically there will be json instruction files dropped into a folder which the application tier will pick up, de-serialize and do backend processing.
As a final question, if we also wanted to use SSRS, is there updated/affordable pricing and hosting options for this as well?
I appreciate any feedback or advice. We are definitely leaning towards Azure and I am trying to wrap my head around what our best configuration and service selection should be.
Thanks in advance

Hi,
A) 2 "Front End" IIS Instances, Load Balanced running an MVC 4.0/.Net 4.5 Web Application
B) A "dedicated" SQL SERVER 2008 R2 server with medium-high resources (ample RAM and processing power)
C) An application server which hosts a Windows Service. This service will require access to the SQL Server listed in B. In addition the IIS "Front Ends" listed in A should have access to a "shared" folder or directory where files can be dropped and
processed by this windows service.
Base on my experience and your requirement, you could try to use this solution:
1.Two cloud service to host your "front end" web application. Considering to Load Balanced, You could use traffic manager to set Load Balancing Settings.
2. About sql server or ssrs, you have two choice:>1,create a sql server vm >2, use sql azure and azure ssrs
I guess all of them could meet your requirement.
3. About your C requirement, which type application is? If it is website, You could host it on azure website or cloud service.
And if you want to manage the file by your code, I think you could save your file into azure blob storage. You could add,delete file using rest API(http://msdn.microsoft.com/en-us/library/windowsazure/dd135733.aspx
) or code(http://www.windowsazure.com/en-us/documentation/articles/storage-dotnet-how-to-use-blobs-20/ ). And the Blob storage could be as a share file
folder.
And for accurately, about the billing question , you could ask azure billing support for more details.
try this:http://www.windowsazure.com/en-us/support/contact/
Hope it helps.
Regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

High-level interrupt handler

Why can I decide to support a high-level interrupt or not? Under what condition does the Solaris kernel will map my hw interrupt (INTA from PCI bus) to a high-level interrupt? When should I refuse to support a high-level interrupt? Why? Can I force my hw interrupt to be a high- level interrupt?
Also think about that, most hw interrupts indicate something important such as the case buffers are full. If they are assigned below the scheduler's, it really does not make sense.
Is it possible to block any hw interrupts? Or I'd put it this way can I prioritize hw interrupts in Solaris?
Thanks
tyh

Hi,
On x86 each IRQ has a software priority assigned to it implicitly by the bus driver, although I think you could override it in the driver.conf. Unlike SPARC, the processor doesn't support a PIL so software priorities are implemented by masking all lower-priority IRQs and re-enabling interrupts.
High priority interrupts, above dispatcher level, run in the context of the current thread on the cpu, normal level interrupts are handled by interrupt threads.
The interrupt threads are the highest priority threads on the system, so will preempt any other running threads. In addition mutexes in Solaris use priority inheritance, so the interrupt threads will get to run.
In general, high level interrupts are allocated to devices with small buffers such as serial or floppy, so that their buffers get serviced in the fastest possible time. Others can afford to wait for just a bit.
Your driver should check to see if its device has been allocated a high level interrupt. If this is the case, the high level handler should clear the interrupt and save the data/status (in the driver state structure perhaps) and trigger your soft level interrupt handler (which will run as a thread).
Blocking of interrupts is done for you when you acquire a spin mutex (ie initialised with an iblock cookie). Such a mutex is required to synchronise access to data shared with a high level handler in your driver.
Please take a look at the Intel Driver writers orientation at:
http://soldc.sun.com/developer/support/driver/docs/Solaris_driver_models/index.html
Hope that helps,
Ralph
SUN DTS

If a material reports to two higher level assemblies in the BOM /Is there a

Hi,
If a material reports to two higher level assemblies in the BOM would creates two planned orders for it. Each of the orders has a different date?
For example
Z is final assembly
In that Y is one assembly in that says X1material in level 2
And the again same material X1 is reporting to Y in levels 5 so here my question is it would create two planned order with different dates?
And
Is there any report to see confirmed time to say machine time / labor time or shall we go for report.
Thx....Srini

Srini,
CS15 can be usefull to check the usage of component in assemblies.
if its used then more then once it can be easily located through this report.
another concern what you expressed is not clear.
But what i understand is same component is used at level 2 and level 4 of a BOM.
assumption from the word levels is , X is used in level 2 its used directly in BOM of Y and Y have some differnt component G which inturn again have X in it .
so at both this levels if the dependent requirement is different, you can get 2 differnet orders use individual /collective indicvator for this material as individual .
If your concern is for BOM position (Item Number) field in BOM then system will create a single plan order even if you set it for individual requirement in material master.here some work around can be possible by maintaining lead time offset IN BOM in item detail screen.
check and come back
Hope it helps you
Regards
Ritesh

Why are my system services disabled for Admin accounts?

Hi all,
I noticed that pretty much all services are disabled in my main (administrator) account. ("make new stickie note" from selection, Grab, import image, look up in dictionary, mail, font etc... Everything is a no go.
I set up a regular account as a test and they all seem to work. I just bought my mac recently and installed 160 gigs worth of documents/profedssional apps and I'm dreading having to go through all that again just so I can have a fully functional os!
Is there an easy way to copy all my settings from my admin account to another account? Or even better, is there a way to turn on all the fun services in the admin account?
Thanks for any info!
J. Wallace
iMac Mac OS X (10.4.8) new Mac user

Welcome to Apple Support Communities
Try deleting the Desktop settings file. Open a Finder window, select the Go menu (on the menu bar) > Go to Folder, and type:
~/Library/Preferences
Then, delete "com.apple.desktop.plist" and "com.apple.systempreferences.plist", and restart. Finally, open System Preferences > Desktop & Screen Saver, and change the desktop wallpaper

I made a mess of my admin accounts need to consolodate please help :)

Hello so i've been having this issue with my main admin account... for about a year now there have been items stuck in my trash folder and safari crashes after a bit. i've taken my computer to apple store and they cannot fix they told me to reinstall OS with disk but when i try to do that it times out... out of frustration i created a new admin account and what do you know i do not have the same issues with the trash... so i copied all the mail folders, preferences and address books over but the passwords didnt follow... so i was only able to get mail on the accounts i could remember the passwords to... so i was using the other account and kind of going back and forth to the old account but now i'm having even more issues with the second account... my macbook pro is all kinds of screwy ...
i need to consolidate the mail i have on both admin accounts... because i have to go back to using the main admin account and i want to transfer all the mail i've been receiving on the other account for the past 2 months to the old account.
can someone please help?

Ok so i figured out what to do (through lots of research and headaches) just thought i'd share my solution... i needed to consolidate two admin applemail accounts with the same email accounts and i forgot all of my passwords...
# To back up Mail preferences (i only did this on my main admin account seeing as though the secondary had the same exact preferences). (i'd suggest also backing up addressbook info as well...)
1. Create a uniquely-named folder on your desktop (or other favorite location- like an external drive). For example, you might call it "Mail Prefs Backups May152005" (adding a date is a good idea).
2. Quit Mail if it's running.
3. In the Finder choose Home from the Go menu.
4. Open the Library folder.
5. Open the Preferences folder.
6. Copy the "com.apple.mail.plist" file to the folder you made in step 1 by Option-dragging the file. Don't remove the original file from its current location (this file contains your Mail accounts information).
7. Close the Preferences folder.
8. Open the Mail folder.
9. Copy the "MessageRules.plist" file to the folder you made in step 1 by Option-dragging the file (this file contains your Mail rules).
10. Copy the "SmartMailboxes.plist" file to the folder you made in step 1 by Option-dragging the file (you guessed it, this file contains Smart Mailboxes information).
11. Finally, copy the Signatures folder to the folder you made in step 1 by Option-dragging the folder. (Your custom signatures, if you use them, are stored here.)
#manually back up Mail messages (i first did a backup of the MAIN admin account on my external drive so that i made sure i didnt accidentally remove any files... then i manually went into each "inbox"/"outbox"/"drafts" of each account and added each email- emails here are only identified with a unique set of numbers and date/times in the info field- that was not in the MAIN admin account to the copy mail account located on my external drive -yes this was VERY tedious- also i had folders that i had to consolidate so i made sure i didnt miss those)
1. Quit Mail if it's open.
2. From the Finder's Go menu, choose Home.
3. Open the Library folder.
4. Copy the folder "Mail" to your backup location, such as a different volume or burnable disc. Important: Do not remove the Mail folder from ~/Library. If you're backing up to the same volume, hold the Option key as you drag the folder to make a copy instead of moving it (a "+" cursor appears).
once i got all this i took all the files i copied/consolidated on my external drive and replaced all the original files in the new Admin account i created (I have to create a new MAIN admin account because the original main admin account is corrupt the second one also has some of the same issues because i was rushing through copying all of the plist/library files over without inspecting each...)
NEXT
* i forgot all the passwords to my email accounts...
Keychains
Keychains are located in your ~/Library/Keychains/ folder. To get to this file in the Finder, choose Home from the Go menu. Open the Library folder, then open the Keychains folder.
i copied that file and backed it up on my external... also i opened it up and found all the passwords i forgot
so this problem for me is solved...
PS the KeyChain is AWESOME! i use firefox and none of those passwords are saved to the keychain but there is an addon password extractor u can export usernames and passwords from firefox with this addon and ad them to your keychain...

Lightroom 3 asks for serial number launching in non-admin account

The following information was provided by Carey Burgess (Adobe Employee):
Does Lightroom 3 launch and work fine in an admin account, but when you launch the application in a standard (i.e. non-admin) account it asks for a serial number?
If so, then it is likely due to a file permissions issue either in the original (admin) account or with the standard account.
(Although you need administrator access to install Lightroom, and you do need proper access permissions to your photos, you should be able to run Lightroom without issue in a standard user account.)
Lightroom 3 stores registration data (the serial number) in a file called Lightroom 3.0 Registration, which is stored by default in one of these locations:
    * Mac OS: /Library/Application Support/Adobe/Lightroom
    * Windows XP: C:\Documents and Settings\All Users\Application Data\Adobe\Lightroom
    * Windows 7/Vista: C:\ProgramData\Adobe\Lightroom
- Check for the registration file in the appropriate location for your system.
If the file does not exist in that location, then ensure you are logged in with the admin account (the one where Lightroom doesn't prompt for a serial number) and check the user-specific location instead:
    * Mac OS: /Users/YOUR USER NAME/Library/Application Support/Adobe/Lightroom
    * Windows XP: C:\Documents and Settings\YOUR USER NAME\Application Data\Adobe\Lightroom
    * Windows 7/Vista: C:\Users\YOUR USER NAME\AppData\Roaming\Adobe\Lightroom
If the file exists in the user-specific location instead, then I would suggest that you ensure that you have quit Lightroom, and then move the registration file from the user location to the default system-wide location. Lightroom should now no longer prompt for serial number when you open it from a non-admin account.
If the registration file did (or now does) exist in the default system-wide location, but you are still being prompted to enter a serial number when opening Lightroom in a standard user account, then that account does not have sufficient access permission to the registration file.
To resolve this aspect, there are two possible solutions (the first being the recommended solution):
1. Change the access permissions on the Lightroom folder that contains the registration file to grant "Read" access for the standard user account. (You can do this for each account individually, or you can use a broader group like Everyone.)
For more information about changing permissions, see one of these articles:
    * Windows XP: http://support.microsoft.com/kb/308419#4
    * Windows Vista/Windows 7: http://windows.microsoft.com/en-us/windows7/What-are-permissions
    * Mac OS: http://docs.info.apple.com/article.html?path=Mac/10.6/en/8342.html
2. Copy the registration file from the system-wide location to the user-specific location for the standard user account. (You would need to repeat this step for each standard user that needs access to Lightroom.)
Reply here if these steps do not resolve your issue, or if you have any questions.

Months ago, I had a routine clearout of old software boxes etc and chucked out my Lightroom 1.0 box. A couple of weeks ago I reinstalled Lion on my mac to find that I cannot register Lightroom. I have the 3.0 upgrade serial, the 2.0 upgrade serial, but the 1.0 was on the box..
I followed the instructions above to find the files in crashplan form before the fomat that hold the registration details. I have tried placing them in the location described, but it doesn't seem to work.
The serials (or something) are in the file, but given in the string that is difficult to decipher - and doesn't work in the registration screen, wrong size and a mix of letters and numbers rather than just numbers as my 3.0 serial is.
Any suggestions for what I could do? Could I send the strings in to Adobe to be deciphered? Perhaps move files around a bit more?
Thanks in advance,
Rog.

Possible conflict with iTunes 7 and non-admin account

I've tried burning cd's in my usual windows account (limited) and it comes up with the error message "disc burner or software not found", but when I log into my admin account and try and burn an mp3 then it burns just fine. I wonder if they changed the way version 7 burns cd's...
Any solutuions or fixes?

I'm not really looking for a way to roll it back. I was just hoping to find a fix for the current version, or make them aware that there is a problem with running it in a non-admin account.
Thanks for the info though!

Lost admin account now standard

My admin account has changed for some reason and now is a Standard account only. So I cannot upgrade any software or perform any admin functions on this iMac G4 now. How can I upgrade this account again to perform Admin functions ?
Many thanks,
Charles

Catch 22
It says start from your Mac OS X Install DVD. However to do so from System Preferences/Startup Disk requires an Administrator account and password which I no longer have as the admin account has disappeared.
Any other ideas anyone please ?
Thanks,
Charles

How to add admin account to SSAS 2012

I am using a Windows 8.1 laptop and I installed MS SQL server with Analysis Services.
I am the only user of the laptop, and my Windows account type is indeed administrator. but somehow it seems this account does not belong to the administrators group.
During SQL server installation, I was stupid enough to forget to add myself as SQL server admin.
Now SSAS blocked my admin access, and I cannot make any changes to SSAS.
That is, I cannot deploy OLAP model, cannot read properties of SSAS instance in SSMS management studio, and of course I cannot add any account to SSAS using the "security" page of the Analysis Services Properties window in SSMS.
Do I have to re-install SSAS, in order to add a server admin account?
Sorry for potential double posting. I asked a pretty similar question in Windows community
Administrator account does not belong to / inherit privilege from the BUILDIN administrators group?
http://answers.microsoft.com/en-us/windows/forum/windows_8-security/administrator-account-does-not-belong-to-inherit/bd8db7c8-64c2-43ee-9716-3eb0e41766dd
Thanks!
Kind regards,
Liz

Have you tried with admin rights? right click on the SSMS icon and choose the option to "Run as Administrator" Also add your account to local administrator if its not currently.
By default, members of the local Administrators group are also granted administrative rights in Analysis Server. If you are a administrator of that box you should be able add yourself.
https://msdn.microsoft.com/en-us/library/ms174561.aspx
If you still cant try below:
Check what account SSAS is running under(local system). change that to your account, restarted SSAS, and reconnected with SSMS. Check if you could see the properties, and add your account, changed the startup account back to local system.
http://www.pertell.com/sqlservings/archive/2011/03/ssas-administrator-accounts/

Why does OWB 9.2 generate UK's on higher levels of a dimension?

When you specify levels in a dimension, OWB 9.2 generates unique key constraints in the table properties for every level, but only the UK on the lowest level is visible in the configuration properties. Why then are these higher level UK's generated? Is this a half baked attempt to implement the possiblility to generate a snow flake model in OWB?
Jaap.

Piotr, Roald and others,
This is indeed a topic we spend a lot of our time on these past months. We are addressing this as (in my old days I had the same problem as a consultant) we know that this is a common problem.
So the solution is one that goes in 2 directions:
- Snowflake support
- Advanced dimension data loading
Snowflake is obvious, may not be desired for various reasons but we will start supporting this and loading data for it in mapping.
If you want a star table, you will know that a completely flattened table with day at the lowest level will not be able to get you a unique entry for month. So what people tend to do is one of the following:
- Proclaim the first of the month the Month entry point (this stays closest to the star table and simply relies on semantics on both ETL and query side).
- Create extra day level entries which simbolize the month, so you have a day level with extra entries
- Create views, extra tables etc to cover the extra data
- Create a data set within the tables that solves the key problem
We have opted for the last one. What you need to do for this is a set of records that uniquely identify any record in any level. Then you add a key which links to the dimension at the same point (a dimension key), so all facts always use this surrogate key to link (makes life in query tools easier).
For a time dimension you will have a set of day records with their months etc in them (the regular star). Then you add a set of records with NULL in the day having months and up. And you go up the hierarchy. For this we will have the ETL logic (in other words you as a designer do not worry about this!). On the query tool you must be a little cautious on counts but this is doable and minor.
As you can see none of the solutions are completely transparent, but we believe this is one that solves a lot of problems and gives you the best of all worlds. We will also support the same data structure in the OLAP dimensions for the database as well in the relational dimension. NOTE that there are some disclaimers with this as we are doing software here...
In principal however we will solve your problem.
Hope this explains some of our plans in this area.
Jean-Pierre

High level description of why an Enterprise Admin account is required for DirSync config

Similar Messages

Maybe you are looking for