PIM Manager settings · Settings > Hybrid AD & workloads
OU for new AD groups
| Key | HybridAdGroupsOu |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Text |
| Default | Blank (groups are never created, only kept in sync) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The distinguished name of the organizational unit (OU=...,DC=...) where the hybrid worker creates AD groups for mirrored PIM groups that do not exist in AD yet. Groups are created as global security groups with the PIM group's name, a display name of <name> (separate group) and its description.
When set
When set: on the next group mirror run (hourly, and at once when the worker sees the change) every mirrored PIM group missing in AD is created in this OU; the continuous sync then fills it with the people who have it activated. Existing groups elsewhere keep their place and have their display name and description corrected.
When blank or default
When blank / at the default: missing AD groups are never created -- they are reported as skipped, and only groups that already exist in AD are kept in sync.
Risk and how to reverse it
The worker starts creating objects in your AD. Groups it created are not deleted again when you clear the setting or remove the PIM group. A wrong OU makes the creates fail (access denied or no such object), reported on the job. Reversible: clear the field to stop creating; remove unwanted groups by hand.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker whose managed service account may create groups in this OU (the AD setup script grants this with -GroupsOu). SuperAdmin to change.
Recommended
Set it to a dedicated OU for PIM groups once the worker is in place, so a new AD-marked PIM group reaches AD without manual work.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack