samba - Oct 2016 - Office365 Password Sync problem

Hi,

Has anyone been able to sync passwords from Samba Version 4.3.11 to  
Office365 ?

I've set up a VM running MS Server 2012 and joined it to the Samba AD  
domain and installed the Azure AD Sync program. User accounts are  
being synced ok put passwords don't seem to be going up ?

When I follow the troubleshooter guide and check status of the  
password sync settings in powershell it says it's all enabled but  
there's no sign its actually trying to do anything.

I found this and am wondering if this applies to Samba AD and if so  
how can I fix it ?

"Scenario 6: Users can't sign in by using their password
In this scenario, the password hash doesn't successfully sync to the  
Azure AD Sync Service. If the user account was created in Active  
Directory running on a version of Windows Server earlier than Windows  
Server 2003, the account doesn't have a password hash. "

Any pointers help appreciated.

Thanks in advance.

-- 
Simon Kelsall
Network Administrator
Direct Dial 020 3393 6835
St James the Great R.C Primary & Nursery School
http://www.stjamesthegreat.org/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

On 22/10/2016 13:33, Simon Kelsall via samba wrote:
> Has anyone been able to sync passwords from Samba Version 4.3.11 to 
> Office365 ?
>
> I've set up a VM running MS Server 2012 and joined it to the Samba AD 
> domain and installed the Azure AD Sync program. User accounts are 
> being synced ok put passwords don't seem to be going up ?
Yes, we have it up & running here. Looks like your user doesn't have the
appropriate rights to sync the passwords.

We've made it a Domain Admin but it looks like that granting it 
"Replicate Directory Changes" & "Replicate Directory Changes
All"
permissions should be sufficient.
See "Permissions for the created AD DS account for express settings"
on
https://azure.microsoft.com/en-gb/documentation/articles/active-directory-aadconnect-accounts-permissions/


Cheers,
Geert