PIM Manager settings · Settings > Hybrid AD & workloads
Per-server group format
| Key | HybridAdServerGroupFormat |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | Text |
| Default | {prefix}AD-SRV-{server}{cloud}{marker} (for example PIM-AD-SRV-FS01-ID-S_AD) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
What it does
The name of the per-server permission group that becomes local administrator on one server. Tokens: {prefix} (your group prefix), {server} (required), {cloud} (the cloud admin suffix) and {marker} (the AD group marker). Server onboarding lists your Windows servers, Discovery offers this group for each one, and once it is defined and mirrored the worker adds it to that server's local Administrators. The server-group sync lane also uses this name to tell server groups from critical groups.
When set
When set: Discovery offers groups with the new name, and server onboarding (hourly) looks for the group with the new name on each server. Groups defined under the old format are no longer treated as server groups.
When blank or default
When blank / at the default: {prefix}AD-SRV-{server}{cloud}{marker} is used, the naming the older PIM-for-AD scripts used.
Risk and how to reverse it
Groups under the old name stay in the servers' local Administrators -- onboarding only adds, never removes. If the new name does not match the mirror pattern (for example without {marker}), the new groups are never mirrored to AD and never reach the servers. Reversible: set the old format back.
Requires
Pro (On-premises Active Directory feature), a running hybrid worker and its server identity as local administrator on the servers. SuperAdmin to change. Depends on HybridAdGroupMarker and HybridAdCloudSuffix.
Recommended
Keep the default unless your existing server groups use another shape; keep {marker} in it so the groups are mirrored.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: only these OUs HybridAdServerSearchOus
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack