Configuring a dedicated account for SharePoint Active Directory Import

Configuring a dedicated account for SharePoint Active Directory Import

  • 1

Yesterday, I needed to help configure a SharePoint Server 2019 User Profile service to import from local Active Directory using the native SharePoint Active Directory Import.

In order to perform Active Directory Import, the service account you specify must have¬†Replicating Directory Changes permissions. Aside from using the Delegate Control wizard in Active Directory Users and Computers, the easiest way is with PowerShell.¬† I generally prefer the PowerShell way of doing things, as it means it’s easy to document, easy to repeat, and easy to ensure everything was done.

We have some documentation scattered about with multiple links to multiple pages, so I thought I’d consolidate it with a little script I wrote to help:

$SamAccountName = "sps-adimport-svc"
$Name = "SharePoint Active Directory Import"
$Password = [System.Web.Security.Membership]::GeneratePassword(15,2)
$SecurePassword = ConvertTo-SecureString -AsPlainText $Password -Force
New-ADUser -DisplayName $Name -SamAccountName $SamAccountName -Name $Name -AccountPassword $SecurePassword -Enabled $True
$RootDSE = Get-ADRootDSE
$DefaultNamingContext = $RootDSE.defaultNamingContext
$ConfigurationNamingContext = $RootDSE.configurationNamingContext
dsacls $DefaultNamingContext /G "$($SamAccountName):CA;""Replicating Directory Changes"

You can return the account details at the console (you’ll need them to complete the Active Directory Import configuration):



Published by Aaron Guilmette

Helping companies conquer inferior technology since 1997. I spend my time developing and implementing technology solutions so people can spend less time with technology. Specialties: Active Directory and Exchange consulting and deployment, Virtualization, Disaster Recovery, Office 365, datacenter migration/consolidation, cheese.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.