PIM Manager settings · Settings > Hybrid AD & workloads
New servers in these OUs are offered for approval as one list
| Key | HybridAdServerAutoGroupOus |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | List |
| Default | Blank (no list: every server is a proposal) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
| Confirmation | PIM Manager asks you to confirm before it is switched on. |
What it does
The organizational units whose newly found Windows servers are collected into one list for a SuperAdmin. Enter distinguished names, one per line or separated by a semicolon; sub-OUs are included. Each OU must lie inside where the worker looks and outside the left-out OUs. Naming an OU creates nothing by itself.
When set
When set: at each listing the hybrid worker puts every listed server in these OUs that has no group on the waiting list shown on this page. Nothing is created until a SuperAdmin approves that exact list. After the approval the worker defines the groups in batches, run after run; the engine creates each group, it is mirrored to Active Directory and added to the server's local Administrators. The groups are empty: nobody gets access until a person delegates it. Each definition is written to the audit trail.
When blank or default
When blank / at the default: no list is built. Every new server is a proposal on Discovery and gaps that a person accepts and commits.
Risk and how to reverse it
After an approval, groups are created without a commit per group, one per server of the approved list. A server a person chose Ignore for, and a server whose group was removed again, are never offered. Clearing the list stops new servers from being offered; an approval already given is still carried out for servers that are in these OUs when the worker runs, and groups already defined stay. Reversible: clear or edit the list.
Requires
Pro (On-premises Active Directory feature), a running hybrid worker with server onboarding, and the OU for new AD groups. SuperAdmin to change and to approve a list.
Recommended
Name only the OUs where every server should be onboarded the same way; leave everything else a proposal.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack