PIM Manager settings · Settings > Hybrid AD & workloads
Read activation end times as UTC
| Key | HybridAdEndTimeAsUtc |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Choice |
| Default | Off (end times are read as before) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on or off. |
What it does
How the hybrid worker reads the time at which an activation ends. Type on or off. On: the end time is always read as UTC, which is what Microsoft Entra sends. Off: it is read as before, which is only exact when the clock of the hybrid worker is set to UTC.
When set
When on: a member leaves the on-premises AD group exactly when the activation ends, whatever time zone the hybrid worker runs in. In a forest with time-limited group membership every active member is re-added once, with the corrected time, in the first pass after the change.
When blank or default
When off or blank (the default): nothing changes compared with earlier versions. On a hybrid worker whose clock is UTC the result is the same as on. On a worker in another time zone a membership can end earlier or later than the activation, by the time zone difference.
Risk and how to reverse it
Switching it changes the end time of running memberships by the time zone difference of the hybrid worker: in a forest with time-limited membership each active member is re-added once with the corrected time, and a member whose corrected end time has already passed is removed in that pass. On a worker whose clock is UTC nothing changes. Reversible: switch it back; members are re-added once again.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker on PowerShell 7. SuperAdmin to change. The hybrid worker picks the change up within a few minutes.
Recommended
Switch it on when the clock of your hybrid worker is not UTC and members leave their AD groups at the wrong time. On a worker that runs in UTC it makes no difference.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack