PIM Manager settings · Settings > Hybrid AD & workloads
Server discovery: only these OUs
| Key | HybridAdServerSearchOus |
|---|---|
| Where | Settings > Hybrid AD & workloads > Hybrid Active Directory (PIM for AD) |
| Type | List |
| Default | Blank (the whole domain) |
| Feature | PIM for on-premises Active Directory · Pro Business, Pro Enterprise, Pro MSP |
What it does
The organizational units the hybrid worker looks in when it lists Windows servers. Enter distinguished names, one per line or separated by a semicolon; several OUs are allowed and sub-OUs are included. A server is always an enabled Windows Server that is not a domain controller.
When set
When set: from the worker's next listing (hourly) only servers below one of these OUs are listed, proposed on Discovery and gaps, and handled by server onboarding. Use Preview to see the number of servers before you save.
When blank or default
When blank / at the default: the whole domain is searched.
Risk and how to reverse it
A server outside the OUs is no longer listed or proposed, and server onboarding no longer adds its PIM group to its local Administrators. It keeps the group and the access it already has; nothing is removed. Reversible: clear or edit the list.
Requires
Pro (On-premises Active Directory feature) and a running hybrid worker. SuperAdmin to change. An OU that does not exist simply matches no server.
Recommended
Leave blank unless your servers live in a few known OUs; then name those OUs.
Related settings
- On-premises Active Directory (hybrid worker) FeatureGates.hybrid.ad
- AD OU (Day2Day Admins) NamingConventions.PathAdmins
- AD OU (High Priv Admins) NamingConventions.PathAdminsL0T0
- AD group marker HybridAdGroupMarker
- Pattern override HybridAdGroupPattern
- Cloud admin suffix HybridAdCloudSuffix
- AD admin suffix HybridAdAccountSuffix
- OU for new AD groups HybridAdGroupsOu
- Per-server group format HybridAdServerGroupFormat
- Shared server-admins group HybridAdServerAdminsGroup
- Never remove HybridAdProtectedMembers
- Groups per batch HybridAdSyncBatchSize
- Batches at once HybridAdSyncParallel
- Read activation end times as UTC HybridAdEndTimeAsUtc
- Server discovery: OUs to leave out HybridAdServerExcludeOus
- Server discovery: last changed within (days) HybridAdServerActiveDays
- Server discovery: only names like HybridAdServerNameInclude
- Server discovery: never names like HybridAdServerNameExclude
- New servers in these OUs are offered for approval as one list HybridAdServerAutoGroupOus
- Server groups created per run HybridAdServerAutoGroupMaxPerRun
- Clean-up: also look for old PIM groups in these OUs HybridAdCleanupOus
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack