2

I've not long started a new job. I have inherited a SP2016 Farm, which I have to manage and develop as part of my role.

I have limited Central Admin access from a previous role with SP2013.

The current farm set up has: 1 DB Server, 1 WFE(/app) server - and a mail server (not currently configured).

The connection from AD to SP does not appear to have been set up correctly - I'm trying run the sync job to AD - when I click run, it rapidly returns to the previous page, so doesn't look at though it's doing anything.

The Sync Connection that is there does point to our AD - with type of Active Directory Import. I have access to the admin user name and password. And the correct containers appear. No additional profiles are ever added.

Do I need to add a separate Domain Controller to have a "full" connection from SharePoint to the AD ?

Or Do I need to tweak something in the sync connection?

None of the current servers have AD FS added as a server role.

Any help would be much appreciated. If you got this far, thanks for taking the time to read.

EDIT: Now I have my User Profiles visible. With regards to authentication - we want to be using Single Sign On, does that now mean I need to include the AD FS role on server?

Can that role be added to the WFE, or does it need to be on its on DC server?

Thanks

Improve this question

2 Answers 2

Reset to default
2

Make sure that the User Profile Sync Service Account has Replicate Directory Changes permission In Active Directory.

The Replicate Directory Changes permission enables the synchronization account to

  • Read AD DS objects.
  • Discover AD DS objects that have been changed in the domain.
  • Does not enable an account to create, modify or delete AD DS objects.

enter image description here

Read the detail steps at Delegate User Profile Synchronization Service Account a Replicate Directory Changes

Improve this answer
1

Yes you will need Domain controller if you want to sync between Active Directory and SharePoint user profile service application.

Domain controller is itself responsible to authenticate user , store user information data etc.

Moreever while configuring the sync , in the "Add new synchronization Connection" , there is an option that asks for domain controller.

You need to enter the domain controller over here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.