Configuring Multiple Windows Domains

To support synchronizing multiple Windows domains to the same Directory Server container (such as ou=people,dc=example,dc=com), Identity Synchronization for Windows uses “synthetic” Windows attributes that contain domain information.

• For Active Directory domains, Identity Synchronization for Windows sets the activedirectorydomainname attribute to the Active Directory domain name (such as east.example.com ) before synchronizing the entry to the Directory Server.

• For Windows NT domains, Identity Synchronization for Windows sets the user_nt_domain_name attribute to the Windows NT domain name (such as NTEXAMPLE) before synchronizing the entry to the Directory Server.

  While these attributes do not actually appear in the Windows user entries, they are available for synchronization in the Identity Synchronization for Windows Console and can be mapped to a Directory Server user attribute. Once Identity Synchronization for Windows maps the domain attributes, they will be set in the Directory Server entries during synchronization and can be used in Synchronization User List (SUL) filters.

  The following example illustrates how Identity Synchronization for Windows uses these attributes. This example assumes that three Windows domains (two Active Directory domains and one Windows NT domain) will be synchronized with a single Directory Server instance.