Active Directory settings

Open Active Directory settings for the school. The first time, the General section is shown; after that the page reopens on whichever section you used last.

General holds the settings that apply to the whole school, in three groups.

Domain — how the connector identifies your domain and builds sign-in names:

• Domain name (DN) — your AD domain in distinguished-name form, e.g. DC=school,DC=local.
• Domain name without DC — the same domain in dotted form, e.g. school.local. (This is the full domain, not the short NetBIOS name.)
• UPN suffix — the domain part of user principal names, e.g. school.org. Enter it without a leading @ — the connector adds the @ when it builds [email protected]. If a stray @ is entered, it's stripped automatically before export so the UPN is never doubled (user@@school.org). Leave it blank and the Domain name without DC value is used instead.

Usernames and display names — how each account is named:

• Remove dashes and apostrophes from usernames — strips - and ' from the AD username (and so from %UN wherever you use it).
• Staff display name format and Student display name format — the templates that build each account's display name, using the name wildcards above (e.g. %TITLE %PF %PS for staff, %PF %PS for students).

Sync options — school-wide switches for what a run does:

• Test mode — when on, the export appends _tst to every username, email address and OU path it produces, so anything the connector creates from that run is unmistakably test data rather than mixed in with your real accounts — easy to find and clean up if something isn't right. Ideal for a first run or after big changes: check the preview and export (the _tst suffix is visible there), then turn test mode off to go live with real names.
• Sync passwords to AD — turn this on to push password changes and resets made in Realsmart to AD. Turning it on doesn't send anyone's current password — see Sync passwords to Active Directory for what is sent and how to line existing users up. This is also what enables the AD password updates log.

Two pairs of switches that used to sit here now live with the settings they belong to: Update OUs after initial creation is in the Organisational units group of the Staff and Students tabs, and Exclude protected staff / students is in the Accounts group of each.

Staff is six groups, in the order you would set an account up:

• Accounts — Process staff accounts is the master switch for whether staff are synced to AD at all. Exclude protected staff leaves out anyone flagged as protected in Realsmart.
• Passwords — the account flags set when an account is created — Change password at next logon, Password never expires, User cannot change password — and a Default staff password (a masked field — leave it blank to keep the stored value).
• Organisational units — Staff OU path is where staff accounts are created, e.g. %TS.Staff.School, and supports the staff wildcards. Leavers OU path is where staff who have left are moved to: set it and suspended staff keep syncing (into the leavers OU); leave it blank and only active staff are exported at all. Update OUs after initial creation — on, the OU path is re-applied on every pass, so an account whose circumstances change moves to the newly-correct OU; off, the OU is only set when the account is first created in AD.
• Teaching status (%TS) — OU if teaching and OU if non-teaching are what %TS becomes for each kind of staff member, so one OU path splits them. Taken literally; wildcards are not expanded here.
• Profile and logon script — Profile path and Logon script, the roaming-profile and script settings applied to staff accounts. Both support the staff wildcards.
• Home folder — Home server name (sent to the connector exactly as typed, the same for every staff account, so it takes no wildcards), then Home local path / UNC, Connect path and Home drive (e.g. H:), which all support the staff wildcards.

Students has the same groups as Staff, so once you have done one tab you know the other:

• Accounts — Process student accounts (the master switch) and Exclude protected students.
• Passwords — the same three flags and a masked Default student password.
• Organisational units — Student OU path, e.g. %YG.Students.School for year-group OUs or %IY.Students.School for intake-year OUs; Leavers OU path (set it and suspended students keep syncing into the leavers OU; leave it blank and only active students are exported); and Update OUs after initial creation, which is what moves a student to the next year group's OU each September.
• Profile and logon script and Home folder — as for staff, with the student wildcards.

Between the OU paths and the profile settings are the two mapping tables that decide what %YG and %IY actually become:

• Year group settings (%YG) — one row per year group in your data. The label on the left is the year group as it appears in Realsmart; type into the box what it should look like in AD (for example Year 07 → 26).
• Intake year settings (%IY) — the same rows, mapped instead to the intake/cohort year (for example Year 07 → Entry26).

Leave no row blank if a path uses the wildcard. An unmapped year group makes the wildcard expand to nothing, so %YG.Students.School becomes .Students.School and those students land in the wrong place, or nowhere. If a whole year group has gone missing from AD, an empty row here is the first thing to check.

Intake-year mappings need attention every September: an intake-year OU doesn't change as a cohort ages, so a new intake has to be added (and the mapping shifted) before sync resumes, or the incoming year group has nowhere to go on the first run.

Both tabs are split into a Staff group and a Students group.

• Groups — the AD groups new accounts are added to, entered one group per line. Under Staff: Staff groups, Teaching staff groups and Non-teaching staff groups — the teaching and non-teaching lists are added on top of the staff list. Under Students: Student groups. These support wildcards too — the staff set on the staff lists, the student set on the student list.
• Scripts — additional scripts to run, with the same split: Staff scripts, Teaching staff scripts and Non-teaching staff scripts (the last two run in addition to the staff scripts), and Student scripts. Same wildcard support.

Select Save settings. The connector picks up the new configuration on its next run. If you have a MAT and want the same structure across schools, many of these fields can be pushed trust-wide — see Apply sync settings across the trust; that screen uses the same sections and groups.