1

I have a Windows Server 2016 on-premise which is being used to manage devices on a local network. We create and manage users for this local network.

One of our guys has accidentally synced our server with our online Office365 E3 Azure Active Directory. This is a problem because every time we make a new user in the server, it gets synced to office365 and a user is created there also. (we don't want this to happen).

How can I unlink our Windows server with our online office365 ?

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • Do you want to not sync all of your on premises users to Office 365 or do you want to not sync only specific users to Office 365? If the former, why? Knowing your end goal will help us answer your question. – joeqwerty Aug 29 '18 at 11:22
  • I want to stop syncing all of my on premise users to Office 365 :) – Patrick Keane Aug 29 '18 at 11:58
  • One of our guys has accidentally synced our server with our online Office365 E3 Azure Active Directory. That requires a bit of setup and is a little hard to do 'accidentally'. You should ask them what they did, then look into reversing/disabling that actual process. – Rob Moir Aug 30 '18 at 7:17
  • By accident... I mean he thought he was doing good and connected to Office. But, we didn't want this to happen and we want just a standalone local network. He didn't consider that we already have a different Azure AD Connect server for managing users on our main network. – Patrick Keane Aug 30 '18 at 10:00
0

If you use Azure AD Connect to sync the user to O365, you could try the follows way to disable the syncing:

  1. Start a PowerShell session on the Azure AD Connect server.
  2. Disable scheduled synchronization by running this cmdlet: Set-ADSyncScheduler -SyncCycleEnabled $false.
  3. Start the Synchronization Service Manager by going to START > Synchronization Service.
  4. Select the Operations tab, and confirm there is no operation with the status in progress.

enter image description here

  • This cmdlet throws an error: Set-ADSyncScheduler : Cannot bind parameter 'NextSyncCyclePolicyType'. Cannot convert value "False" to type "Microsoft.IdentityManagement.PowerShell.ObjectModel.SynchronizationPolicyType". Error: "Invalid cast from 'System.Boolean' to 'Microsoft.IdentityManagement.PowerShell.ObjectModel.SynchronizationPolicyType'." – Patrick Keane Aug 30 '18 at 15:56
0

You should be able to:

Uninstall AzureAD Connect from the server then run the following (AzureAD PowerShell V1 command)

Set-MsolDirSyncEnabled –EnableDirSync $false

This should convert your users that are synced to cloud accounts and keep existing passwords (assuming password hash sync is enabled).

If you don't need the synced user objects in Office365, you can leverage the sync to help you clean up. Before disabling AzureAD Connect, create an empty OU, re-run the AzureAD Connect wizard then select the empty OU to sync with. When the sync runs it will not see any users, and it will delete the synced accounts in AzureAD/Office365. Once the directory is cleaned up you can execute the steps above to disable syncing on the directory.

REF: https://docs.microsoft.com/en-us/powershell/module/msonline/set-msoldirsyncenabled?view=azureadps-1.0

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.