Active Directory extension settings

Extension is enabled  

Enable or disable the Active Directory extension.

Please, see the Select Extensions article section to determine which extensions could be used in your environment.

Active Directory default credentials

Specify the account to connect to Active Directory Domain Controller(s).

Active Directory connection account, specified in the Active Directory domain credentials setting, must have the Domain Admin permissions (or up to the level required for desired tasks to be completed).

For more information, please see System Requirements and Permissions required for Active Directory management articles.

Managed domains

The Managed Domains table has the list of Active Directory domains available for management.

All managed domains are grouped by forests:

1. All domains from the forest where the Cayosoft Administrator service is installed.
2. Forests with trusted domains. Trusted domains are the domains that have trust with the domain, where the Cayosoft Administration service is running. Trusted domains are used during operations with Exchange-linked mailboxes and in the AD Users | Create User Copy in Another Domain automation rule.
3. Forests with untrusted domains.

To view or modify Forest settings you should click Configure. 

Managed domains setting works as follows:

1. Cayosot Administrator service enumerates all domains from the forest where the service is installed and all trusted domains.
2. If the ADWS service is stopped on the selected domain controller when the Cayosoft Administrator service is starting, this domain will not be displayed on the list.
3. In each domain DС is automatically selected during initial discovery, using the DC Auto selection method.
4. You can set Alternative DC to use in case the primary DC is identified as unavailable. 
   Tip: If you select Domain Controller manually, we recommend selecting the one that is close to the Cayosoft Administrator Service and is not under high load by other services.
5. Specify credentials manually for each forest and its domains in the list. Use Default Credential setting uses the credential specified in Active Directory default credentials. If domain credentials are not specified, forest credentials are used. If forest credentials are not specified Active Directory default credentials are used.  
6. If there are some domains you don't need to manage, you can uncheck them to disable them. If a domain is disabled, it is not available for management, and the objects from this domain are also excluded from the Global Search.
7. Click Add... to add new trusted or untrusted forests and their' domains for management. 
8. If you added a new domain to one of the managed forests or added a new UPN suffix to a domain, you should click Discover to see this domain in the Managed Domains list. After that, you will see a new domain suffix in web actions in the Web Portal and can use it in automation rules in the Administrator Console.
9. If you see the domain name displayed in red, it means this domain is not available for management. At some point in the past, the domain was available, and the Domain Controller or credentials for this domain were specified manually and saved. But now when the Cayosoft Administrator service enumerated domains on start, this domain was not found in the domains list.
10. To remove deleted domains, domains' suffixes, and domains and forests that were added manually click Clear. It will also clear DC credentials and other settings in the table. Then a domain discovery procedure will be run to add the default list of managed domains and trusted forests with default settings.

Forest Settings

You should click Configure to view or modify Forest settings.

1. Default forest credentials - default value is set to <Use Default Credentials>, which points to Active Directory domain credentials.
2. Default domain - It is defined automatically. By default, this setting is set to the domain where the Active Directory connection account is located. The value of this setting is used as the default scope in the Limit scope to this domain or OU setting for Active Directory automation rules.
3. Global Catalog server - it is selected by default. Please, be sure that the correct Global Catalog server was selected. Global Catalog server is used in Global Search functionality and automation rules.
   Note: If the forest name is displayed in red, it means that the Global Catalog server is unavailable.
4. Alternative Global Catalog server - you can set another Global Catalog to use in case the primary Global Catalog is identified as unavailable.
5. Default domain suffix - specify the default domain suffix to use as a UPN suffix during the creation of new objects.
6. Exchange management - specify the scenario for the Exchange management that you plan to use in your environment:
   1. Enabled for all recipients, with Exchange Extension.
   2. Enabled for remote recipients only, with direct attributes update in AD.
   3. Enabled for remote recipients only, using Exchange Management Tools (This functionality is available starting from the 11.2 version of Cayosoft Administrator).
   4. Disabled - no mailbox management actions are available for Active Directory objects.
7. A Delete button on the Forest Settings form if the forest is untrusted allows deleting the forest from the Managed Domains table.

Default country/region

By default, this setting is set to the computer region of the computer running the Administration Service.

When a new user is created in the Web portal or by Cayosoft Administrator automation rules, the Default country/region value is set to a user country. Then, if this user is provisioned to Office 365, a user country is automatically used as an Office 365 location.

For more information about Office 365 settings, please see Microsoft Office 365 extension settings article.

User Name Generation Rules (Web Interface)

Validate Display Name uniqueness

This setting allows turning on\off the uniqueness check of the Display Name user attribute.

Display Name generation rule

Full name (cn) generation rule

UserPrincipalName prefix generation rule

SamAccountName generation rule

Primary email prefix generation rule

Cayosoft Administrator can automatically generate object attributes.

Select a generation rule from the list or create your own generation rule to satisfy your organization's requirements and policies.

Name conflict resolution

All naming attributes should be unique in Active Directory. Cayosoft Administrator provides automatic name uniqueness check and conflict resolution. A unique name can be generated with alternative generation rules and applying unique counters.

Select the desired behavior when a name conflict is identified:

1. Stop and notify the user
2. Continue and suffix the user name with a numeric counter
3. Try the alternative generation rule (see next section), and if fail-stop and notify a user
4. Try the alternative generation rule (see next section), and if fail - continue and suffix the user name with a numeric counter

For more information, please see the Name Conflict Resolution and alternative names generation section.

Alternate Name Generation Rules (Web Interface)

Alternate Display Name generation rule

Alternate Full Name (cn) generation rule

Alternate UserPrincipalName prefix generation rule

Alternate SamAccountName generation rule

Alternate Primary email prefix generation rule

If the Name conflict resolution option is set to Try alternative generation rule, and if fail-stop and notify a user or Try alternative generation rule, and if fail - continue and suffix the user name with a numeric counter, Cayosoft Administrator will use Alternate Name Generation Rules to generate attributes during user creation or user cloning.

Select generation rules from the list or create your own generation rule to satisfy your organization's requirements and policies.

Counter format

If the Name conflict resolution option is set to Continue and suffix the user name with a numeric counter or Try alternative generation rule, and if fail - continue and suffix the user name with a numeric counter, the next available numeric counter will be added to the generated string. By default, the counter starts with 1.

If you want to customize the counter format, use this setting to define the new format. For example, if you need to use two digits in the counter, you should enter 00 in the Counter format field.

Other User Provisioning Settings (Web Interface) 

Run Mailbox post creation tasks

Run Onedrive post creation tasks

The Run post creation tasks settings work as follows:

1. The default value is No.
2. Set this setting to Yes if you want to either create a mailbox or provision to OneDrive after these Web actions are completed: New User (AD), Clone User, Enable-Mailbox, New Linked Mailbox, and New User with Linked Mailbox.
3. To run the post creation tasks, make sure that:
   • Active Directory, Microsoft Hybrid, Microsoft Office 365.
   • A corresponding Office 365 license is assigned to the user at creation, either manually or automatically.
   • Corresponding post-creation rules are configured, see below.

For more information, please see the Select Extensions article section to determine which extensions could be used in your environment.

(Deprecated) Run Skype post creation tasks

New User, Clone User, and other web action forms for the user have mailbox control buttons to select the mailbox creation options. These buttons are:

• No mailbox
• Exchange On-Premises 
• Exchange Remote button  
• Office 365 

The Show email prefix and suffix setting work as follows:

1. Set this setting to Yes if you want to show mailbox controls for email prefixes and suffixes in these Web actions: New User (AD), Clone User, Enable-Mailbox, New Linked Mailbox, and New User with Linked Mailbox. 
2. The default value is No.

The display of mailbox control buttons depends on enabled Cayosoft Administrator extensions. For more information, please see the Select Extensions article section to determine which extensions could be used in your environment.

Cayosoft Attribute policy can control the visibility of these buttons on Web action forms. For more information, please see the Set visibility of Mailbox buttons for New User, Clone User, and Enable-Mailbox Actions and Set the default Mailbox type button for New Shared, Room, and Equipment Mailboxes sections in the Attribute policy documentation.

Customize columns (Web Interface)

Default columns for AD Users query

Default columns for AD Groups query

Default columns for AD Computers query

Default columns for AD Contacts query

Default columns for AD Organizational Units query

Default columns for AD Group members query

Cayosoft Administrator has centralized columns' settings for Active Directory Web queries shared among all Admin Units.

You can customize the following column parameters: change column names, add or remove columns, and define whether each column is visible by default.

For more information about column customization, please see the Web Query columns customization article.

Password Generation Options

Generated password length

When generating a new password, the Cayosoft Administrator will use this value for the new password length. For manually entered passwords, this setting determines the least number of characters that can make up a password for a user account.

Number of non Alphanumeric characters 

Specify the number of nonalphanumeric characters the generated or manually entered password must contain.

Password policy

Password policy provides granular control over password complexity rules:

1. Length & Character:
   1. Password length
   2. Alphabetical characters 
   3. Numeric characters
2. Special Characters
3. Pattern & Sequence:
   
   Note: Prevent sequence of UserID characters in the password policy using the SamAccountName attribute as UserID.

If a password policy is specified, the options 'Generated password length' and 'Number of non Alphanumeric characters' are ignored, only the password policy settings are taken into consideration when the Cayosoft Administrator generates new passwords or checks manually entered passwords for complexity.

The password policy in Cayosoft Administrator should be at least the same complexity as you have in Active Directory and Microsoft 365 (if you're creating hybrid users). Otherwise, Cayosoft will allow you to create a weak password but then you may receive errors directly from AD or Microsoft 365 that the password does not meet the complexity requirements. 

Password complexity description

Specify the password complexity description. The description will be displayed on the Reset password form in the Web Portal.

You can use HTML tags to format the text.

Cayosoft Suspend Policies (Legacy Policies)

Run related Office 365 user suspend and undo suspend

Specify whether to run related Office 365 user suspend and undo suspend actions when the Active Directory user is suspended or unsuspended. 

Default user Suspend policy

Default user Undo Suspend policy

Default group Suspend Policy

Default group Undo Suspend policy

Cayosoft Administrator provides suspend capabilities of user and group accounts in both Active Directory and Office 365. You can suspend users or groups manually via Web Portal and automatically with automation rules.

Use these settings to specify default suspend policies for users and groups.

For more information about suspend automation rules and suspend Web actions configuration, please see these articles: Using suspend policies with Cayosoft Administrator

Creating and saving user suspend policies

Best practices for suspending settings XML file usage

Cayosoft Suspend Default Configurations

Use modern suspend rules and configurations

Starting from the 10.3 version, Suspend Tool has been migrated to Administrator Service with significantly improved functionality. For details, please see this article about the New Suspend Configuration.

For new installations, this setting is set to 'Yes' by default. For installations upgraded to 10.3 or above this setting is set to 'No' by default. If you want to use the New Suspend functionality you should set this setting to 'Yes'. 

Default AD user suspend configuration 

Specify the suspend configuration that should be applied during the object suspend.

Each Suspend Configuration has several settings that are split into sections and should be customized based on your requirements. Here is the list of Active Directory Suspend Configurations with links to corresponding documentation articles:

1. AD User Suspend
2. AD User Undo Suspend
3. AD User Terminate
4. AD Group Suspend
5. AD Computer Suspend (New functionality)

Default AD user undo suspend configuration

Default AD group suspend configuration

Default AD computer suspend configuration 

Home Folder Acces Credentials

File shares

1. By default, Administrator Service uses the Active Directory default credentials to access the shared folders.
2. Click Add Path to specify the SMB root folder (e.g. \\Server\HomeFolders\root) and credentials that will be used to access this folder.
3. Different folders can have different credentials for access.
4.  if Active Directory default credentials are empty, and the Administrator Service is running under the Local System account you need to specify the shared folder credentials otherwise you will get the error.

Advanced Settings

Web Portal scope DN (Distinguished Name)

Web Portal computers scope DN (Distinguished Name)

Web Portal groups scope DN (Distinguished Name)

These settings are deprecated.

Use the AD Users, AD Groups, and AD Computers web queries in the Active Directory Administration Unit.

Create Active Directory object cache

If you have groups with large members lists of 8000 members or more, you may start experiencing delays opening the members list for these groups in the Web Portal.

In this case, you can turn on AD caching to improve the performance of Membership and group Properties web actions:

1. Set Create Active Directory object cache to Yes
2. Save changes
3. Navigate to Membership web action and group Properties web action and set Resolve and show member display names (legacy) also to Yes.
4. Save Changes
5. Restart the Admin Service

When this setting is set to Yes, Admin Service loads and stores Display Name and User Principal Name values in the AD cache for all users from all managed domains in a forest where Cayosoft Admin Service is installed. So, when you click Membership web action group member details are taken from this cache, instead of searching AD.  

Web query default filter

If you need to completely exclude certain users, groups, or computers from delegated management with the Cayosoft Administrator Web portal, specify the filter condition that will be applied to all default web queries: AD Users (including queries for inactive and locked out users), AD Groups, AD Computers, AD Contacts.

Disable partial name search

Use this setting to improve search performance by removing part of the filter by name. Disabling partial name search has an impact on user experience, see note below.

Map cloud users by UPN

If you configure Azure AD Connect to use any attribute other than UserPrincipalName for the name of the AzureAD user, set this setting to No (try anchor attributes first).

For details, see the How to map Active Directory users to Office 365 cloud users article.

DN lookup chunk size

If automation rule or web action uses bulk processing for object management, all objects are split into queries.

This setting defines the maximum number of objects in one query.

The default value is 500.

Operation timeout (minutes)

This setting defines the client-side timeout, the period the Cayo Administrator waits for Active Directory to respond. The default timeout is 2 minutes.

When executing heavy queries against Active Directory, it is recommended to increase the Operation timeout to 10 minutes. 

An example of such a query could be the use of LDAP_MATCHING_RULE_IN_CHAIN in the AD Users membership rule for Dynamic Group when such a query should result in 20K+ items.

Dynamic Group target exclusions

This setting prevents selecting built-in AD groups as Dynamic Group targets to prevent escalation.

You can set multiple values separated by ";",  each value is a mask for target group DN. Example: *CN=Builtin,DC=*;*CN=Users,DC=*

1. The Show mailbox controls setting is renamed to Show email prefix and suffix.
2. The Mail attribute generation rule (Primary SMTP) setting is renamed to the Primary email prefix generation rule.

Dynamic Group target exclusions and Map cloud users by UPN settings are added.

Clear DN Cache command is added.

Disable partial name search setting has been added.

1. Managed Domains setting is modified
2. Forest Settings form is added
3. The Discover button is added

Operation timeout (minutes) setting is added.

1. Validate Display Name uniqueness setting is added.
2. Run related Office 365 user suspend and undo suspend setting is added.

New settings are introduced: 

1. DN lookup chunk size 
2. Default columns for AD Group members query