AD advanced settings

4 steps 4 min Updated 4 November 2026

Most Active Directory configuration lives on the main Active Directory settings page. This advanced page holds two things that need their own editors: exclusions and AD attribute mappings. They feed the same connector, so a change here affects its next run.

Looking for the year group or intake year mapping? Those are on the Students tab of Active Directory settings, beside the OU paths that use %YG and %IY.

Before you start

You must be a school admin with sync settings permission, with the school selected in the switcher.
User exclusions match on Realsmart username or email address, and group exclusions on Realsmart group names, so have those to hand.

Steps

Step 1: Open AD advanced settings

In the sidebar, go to Active Directory → Advanced settings. (There's no link to it from the Settings page itself; the page's Back to settings button goes the other way.) The page is called AD advanced settings and has three cards: Exclusions, Year group and intake year mapping (which only points you to the Students tab) and Field mapping.

Step 2: Set exclusions

Use the Exclusions card to keep people out of the list of accounts Realsmart sends to your AD connector. The connector doesn't create, update, move or disable anyone who isn't on that list, so an excluded person's AD account (if they have one) is left as it is.

Exclusions don't stop password sync. If Sync passwords to AD is on, a password change made in Realsmart is still sent to the connector for an excluded person. See Sync passwords to Active Directory.

Put one entry per line in each box. Don't add commas or spaces around an entry.

User exclusions — each line is matched against the person's Realsmart username and their email address. Capital letters don't matter. Use * as a wildcard for any run of characters:

Entry	Leaves out
`jsmith`	the user whose username is `jsmith`
`[email protected]`	the user with that email address
`temp*`	every username starting `temp`
`*svc`	every username ending `svc`

Group exclusions — each line is the name of a Realsmart group (as it appears on the Groups page), not an AD group. Everyone in a matching group is left out of the AD export. Use % as the wildcard here, not *:

Entry	Leaves out the members of
`governors`	the group called `governors`
`year10%`	every group whose name starts `year10`
`%-cover`	every group whose name ends `-cover`

To keep a set of people out of AD, create a group in Realsmart (for example ad-exclude), add the people to it, and put ad-exclude in Group exclusions. Adding or removing someone in that group then changes who is exported, with no need to edit this page again. See Create a group — leave the new group Protected so it isn't removed while it's empty. Like any group, it's also sent to Google or Microsoft if your school syncs groups there.

Step 3: Map AD attributes to source fields

The Field mapping section lets you fill selected AD attributes from a Realsmart source field. For each AD attribute — Office (physicalDeliveryOfficeName), Pager, and Description — pick which Realsmart field supplies it, choosing from: Forename, Surname, Username, MIS ID, UPN/Staff Code, or Job Title (or leave it as "-" to fill nothing).

For example, mapping Description to Job Title writes each staff member's job title into the Description attribute of their AD account.

Step 4: Save

Select Save advanced settings (you'll see AD advanced settings saved.). The connector applies the exclusions and mappings on its next run. Check the effect with Preview the Active Directory export before relying on it.

How OU paths are written

The OU paths on the Active Directory settings page are written with dots between the OUs, innermost first — the opposite way round from how you'd read them in Active Directory Users and Computers. The connector turns each part into an OU= and adds your domain at the end.

For example, Teaching.Staff.CityTest puts the account in the Teaching OU, inside Staff, inside CityTest: OU=Teaching,OU=Staff,OU=CityTest followed by your domain. With a wildcard, %TS.Staff.School puts each member of staff in their teaching or non-teaching OU inside Staff, inside School.

Did this work for you?

If a step looked different on your site, tell us and we'll update the screenshots.