Directory Sync Tool

According to our customers, using Microsoft's directory synchronisation tools can take many weeks, or months (in the case of multiple directories) to set up, test and be confident that synchronisation works.

With UnitySync you can achieve the same in a few hours.

No. Updates are done directly between directories without an intermediate directory. No meta-directory is needed or added.

No additional database is needed to synchronise directories.

No. UnitySync uses local domain accounts so there is no need for extra software or servers.

There are several ways to implement UnitySync, but let's take a look at three of the most common options.

2 Directories (simple) - If you only have two directories to synchronise, one copy of UnitySync with connections to both directories works best. This implementation solution is perfect for: two companies that have merged two interdependent organisations
To install UnitySync on any server in your network you’ll need:

• a license for one copy of UnitySync a directory license for each directory being synchronized
• a license for an optional lab copy if you do a lot of testing

Multiple Directories (centralised) - If there are multiple directories, synchronising with a master/hub directory
is a better option. We call this a master/hub-spoke implementation.
This implementation option is perfect for:

• multiple interdependent organisations
• a parent organisation with three or more sub-organisations
• a parent company with three or more autonomous subsidiaries
• an umbrella organisation with multiple interdependent
  parts/sub-organizations

To install UnitySync near or on the master/hub directory server you’ll need:

• a license for one copy of UnitySync
• a directory license for each directory being synchronized
• a license for an optional lab copy if you do a lot of testing

Alternate - Multiple Directories Option (decentralised) - If a regular master/hub – spoke directory implementation isn't the best solution, there is yet another implementation option. Installing UnitySync on or near remote directories gives admintrative control to each site/directory location.

This implementation option is perfect for:

• low bandwidth or irregular connectivity situations 
• when administration at each directory site is required or preferred

To install UnitySync this way you’ll need:

• a license for the initial copy of UnitySync
• a license for each additional copy of UnitySync, per server
• a directory license for each directory being synchronised
• a license for an optional lab copy if you do a lot of testing

Each of these options have multiple variations and can be adapted to all kinds of environments.

There’s no need to worry. UnitySync supports LDAP/SSL encryption, encrypts all passwords and text data files (e.g. LDIF data), as well as text input files.

Managing who needs access rights to update directories is dependent on how UnitySync is deployed (see below).

Yes. UnitySync can be deployed in such as way that ‘write’ access is given to each OU/container’s owner, and ‘read only’ access to what they don’t own.

For example, in the decentralised model described earlier, there are multiple local administrators with read access to all directories and write access to their own.

This way, each part of the company is responsible for updating only their directory under their own control. Each company can also pick and choose which entries and attributes are synchronised thanks to UnitySync’s easy-to-use attribute mapping and exclusion processing.
Where organisations are willing to give one administrator read/write access to all directories, a centralised model can be adopted. This has the benefit of requiring fewer UnitySync licences.

You can use UnitySync to create user, contact, group, etc., in fact, any object type you need. For example, UnitySync creates mail forwarding contacts in Active Directory during a synchronisation run by default.

Yes. UnitySync can synchronise only parts of the source directory, for example, it can:

• exclude or include specific Organisational Units (OU)/containers
• exclude or include parts via specific values in account attributes
• include different parts of the source directory and place them in different locations in the destination directory

You can also tell UnitySync to eliminate any of the standard attributes from synchronisation (i.e. display name, first, last, phone numbers, etc.), and add new attributes or create values for a specific attribute.

UnitySync can be configured to send out notification messages either globally or on a ‘per connection’ basis.

You can also choose to receive emails anytime a synchronisation runs (i.e. a summary email) or only in the event of a problem.

Yes. If your HR system is the primary database via which all personnel-related records are maintained, you can take advantage of UnitySync to reduce the workload and potential for manual error in maintaining Active Directory user accounts and at the same time enforce a consistent and timely security policy throughout the organisation.

The process of synchronising any changes or modifications can be to used provision new AD user accounts or to keep user contact information in sync with any changes (e.g. a name change following marriage or a change in department or ‘security level’).

Note that when creating Active Directory users you can provision a default password or create a password based on source attributes.
You also can use this service to quickly close down an AD user account as a result of a member of staff leaving the organisation (an occurrence that is typically tracked by the HR department as a matter of course, but not necessarily relayed to the IT department as a priority).

Many different HR systems are supported by using an ODBC connection or even flat (csv) data files. Certain systems, such as SAP, also support LDAP and SQL connections.

Imagine… Company A takes over company B, and company A’s email domain is will be what is outwardly visible, but email replies need to be internally routed to company B’s legacy email system.

UnitySync supports this scenario with its Swap Proxy service which synchronises entries from company B’s directory with company A’s directory at the inbound gateway.

This allows the ‘master directory’ to route mail back to the original domain. Voilà, a single inbound messaging domain that leaves internal domains in place!

UnitySync lets you run a simulation with an expanded log file for a detailed view of the results of any synchronisation activity. This is a great feature to see what effect any proposed changes will have without actually changing the directory.

If you run a synchronisation but need to back-track for whatever reason, UnitySync has an ‘unsync’ function that will remove the synced users from a destination LDAP system.

Yes. As long as it is unique, UnitySync can read a record and use the value of a selected attribute in that record as the basis for updating the corresponding record in another directory. It can also create new records where a duplicate doesn’t exist.

This in effect lets you Join directories without risking creation of duplicates.

Other applications to which UnitySync can be put include:

• Creating a backup forest – You can use UnitySync to create mail enabled user objects in a separate Active Directory forest to use as an emergency off-site messaging server.
• Synchronise an Admin Forest and a Messaging Forest - UnitySync can be used to keeps account administration and messaging administration separate in Active Directory by connecting both forests. Just create disabled user objects (place holders) in the messaging forest. UnitySync also updates attributes on the disabled account whenever there is a change the source admin forest.
• Synchronising public keys - UnitySync synchronises X.509 public keys by default, creating mail enabled objects. It can also sync just those entries that have public keys and ignore the rest of the directory.