PIM Manager settings · Settings > Hybrid AD & workloads
Shared server-admins group
| Key | HybridAdServerAdminsGroup |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Text |
| Default | Blank (none) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
One AD group (name, or DOMAIN\name) that server onboarding also adds to the local Administrators group of every onboarded server -- next to that server's own per-server group. It replaces the shared all-servers group of the older PIM-for-AD scripts.
When set
When set: on the next server onboarding run (hourly) the worker adds this group to local Administrators on every server whose per-server group is defined and already exists in AD. Its members become local administrators on all those servers.
When blank or default
When blank / at the default: only each server's own per-server group is added.
Risk and how to reverse it
This widens who is local administrator on every onboarded server. Onboarding only adds: clearing the setting or changing the group does NOT remove it from the servers -- you remove it by hand. Do not use a PIM just-in-time (mirrored) group here, and do not rely on it for the worker's own rights: the worker gets its server rights through its own permission group.
Requires
Pro (On-premises Active Directory feature), a running hybrid worker whose server identity is local administrator on the servers (set by the servers GPO from the AD setup script). SuperAdmin to change.
Recommended
Leave blank unless you deliberately want one group with admin rights on all servers; prefer the per-server groups with just-in-time activation.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack