Hi
im hitting my head off a brick wall with DirSync - here's my scenario:
- Single AD Forest with multiple child domains - 1 child domain per customer
- Each Customer has 2x Office 365 Tenancies, one for staff and one for students (I know the work around for the multi-dirsync installs in a single domain is not supported but im willing to work with it / manage the MSOL accounts in the local directory manually)
- Child domains are NOT routable to each other - this is for security and customer isolation <-- this is where the problem starts
when installing DirSync into a child domain I go through the wizard but get an error that after research appears to be because the child domain is not able to talk to all other DC's in the other child domains (this was a similar issue in ILM2007 but once the Live@Edu Management Agent was installed you could manually edit the sync'd domains from the MA and then continue on with provisioning / sync) because the DirSync setup doesn't complete I don't get the MA's installed into FIM so I cant manually edit them (I know this isn't officially supported either) to exclude the other customers domains
so the question - is there a work around for this? ideally I need to get the MA's installed into the FIM console then edit them and all things should be happy. if I wasn't a seasoned MS products user I would ask the question as to how such a product could be released without considering this scenario or providing a work around but I know the answer to this one! DirSync is a great tool but I just don't understand why it wants to look at the whole forest when all I want to sync is one domain at a time!
I hear rumours that the new DirSync will be available in June and will bring with it the return of password Sync but I've been hearing this for over 18 months now from inside and outside of MS so im not holding my breath but perhaps this removes this issue / handles forests a little better?
any help would be appreciated!
Mike