Active Directory password updates
When password sync is on, password changes made in Realsmart are queued for the Active Directory connector to apply on-prem, so a user's accounts stay in step. This page is a read-only log of those changes for the school, with three summary figures and a list of any passwords AD never confirmed. It changes nothing itself — it's a record of what has been captured.
When this page appears
This page only applies when Sync passwords to AD is switched on in Active Directory settings: that is what puts Active Directory → Password updates in the sidebar. With password sync off, there is nothing to capture, so the page has no purpose. You need permission to view logs (the same permission as the Logs pages), because the page names the people whose passwords changed.
What you see
Three summary tiles at the top:
- Pending password updates — how many members have a password change that AD hasn't confirmed yet: still queued for the connector, or collected by it and waiting for it to report the password set. A non-zero count is normal briefly after changes happen; it clears as the connector reports each password set. It's highlighted when above zero.
- Not confirmed by AD — how many people's newest password the connector collected 4 times in the last 7 days without ever reporting it set. Realsmart has stopped sending these. It's highlighted when above zero, and the list below names them.
- Connector last ran — how long ago the connector last finished a full run (as a friendly "x minutes ago", or Never if it hasn't completed one yet). A password-only run doesn't update it. This is a quick way to confirm the connector is alive.
A "Not confirmed by AD" list, shown only when that count is above zero: each person, linked to their user record, how many times the connector collected the password (Tries) and when it last did (Last tried), newest first. Usually the password doesn't meet your domain's password policy, or the account isn't in AD: check the connector's log on your server for the reason, then set a new password for the person. They drop off the list as soon as a new password is queued for them.
A "Recent password updates" table listing the 200 most recent captured changes (newest first), with:
- User — who the change is for, linked to their user record.
- Password — always shown as "Encrypted value stored". The actual password is never displayed anywhere in Realsmart; it is stored encrypted and only used by the sync.
- Updated — when the change was captured (day/month/year and time).
Reading it
- Empty table (No password updates — No passwords have been received from Active Directory yet) — no password change has been captured since Sync passwords to AD was switched on. That's expected on a new setup. (The page's subtitle says Passwords pushed up from Active Directory, but the log lists the changes made in Realsmart.)
- Pending count won't clear — the count only drops when the connector reports a password set, not when it collects it. If the figure stays high and Connector last ran is a long time ago, the connector isn't running: check its scheduled task on your server, revisit Set up Active Directory sync, and check the connector app and its log. If the connector is running, it's collecting the passwords but AD isn't taking them: Realsmart offers each one up to 4 times, at least 6 hours apart, then moves it to Not confirmed by AD (see Sync passwords to Active Directory).
What gets sent to AD
Which Realsmart password changes reach Active Directory — and which deliberately don't, including what happens when you first turn the toggle on — is covered in Sync passwords to Active Directory.
Related
Was this guide helpful?
We read every response — it decides what we rewrite next.
Thanks for your feedback.