Choosing a sourceAnchor for Multi-Forest Sync with AAD Connect – Part 6, Moving off objectGuid

Part 1, Introduction

Part 2, Lab Setup

Part 3, An Aside on EmployeeID

Part 4, Using msDS-SourceAnchor

Part 5, Using mS-DS-ConsistencyGuid

Part 6, Moving off objectGuid

Correcting an earlier choice of objectGuid

As it turns out, if you’ve previously selected objectGuid as you sourceAnchor, you can very easily change to using msDS-SourceAnchor or mS-DS-ConsistencyGuid by making the rule edits described in Part 4 of this series for msDS-SourceAnchor or Part 5 of this series for mS-DS-ConsistencyGuid .

You don’t have to reinstall AAD Connect.

You don’t have to re-provision users.

Just make the rule edits.

What about when other attributes are used for sourceAnchor?

Now you’re in a world of hurt.

You need to uninstall AAD Connect and have the wizard remove all components including the sync database. You need to delete your users from Azure Active Directory and you need to start again.

Depending on the services you’re using with your Azure Active Directory tenant, you may be facing mailbox export/import operations and various other problems.

I would recommend a support engagement with Microsoft or a trusted cloud partner to help you through it.

Conclusion

Moving away from objectGuid over to msDS-SourceAnchor or mS-DS-ConsistencyGuid as your sourceAnchor is relatively easy.