Prerequisites
To set up a connection between the Password Reset app and Microsoft Active Directory (AD), you must first create a new user in your Active Directory with the following assigned roles:
Replicating directory changes.
Replicating directory changes in the filtered set.
Replicating directory changes all.
Read.
Complete this step before proceeding. If you are unfamiliar with granting these permissions, please refer to the following guide: Permission to reset passwords
Downloading SYNC and Configuration Files
Download the Connector: On the Password Assistant Overview tab, click the Download Local AD Password Assistant Executable button.
Requirements: The machine running this application must have network access to your AD server (running it directly on the AD server is optional) and must have .NET Framework v4.8 or higher installed.
Download Configuration Template: On the Overview tab, click the Download Configuration Template button. Save this file as PasswordAssistant.conf and place it in the same folder as your downloaded password assistant application.
Policy Setup: When setting up a policy for the AD connector, ensure password reset requests are directed to AD from accounts created by your AD/SSO integration:
Check the box next to your app in the Login Providers section.
Select Local AD in the corresponding drop-down menu.
Select the lookup field in the User Lookup Map for Local Ad section to map iiQ and AD.
Supported Integrations: ClassLink SSO, Enboard SSO, Google SSO, Microsoft Active Directory, Microsoft ADFS, Microsoft Azure, and Rapid Identity.
Configuring the Active Directory Integration
Extract Files: Extract the Microsoft AD Connectors file and move PasswordAssistant.conf into the unzipped folder.
Launch Application: Run IncidentIQ.Connectors.MicrosoftAd.exe to open the configuration window.
Configure Settings: Modify the following default settings: ad.username, ad.password, ad.domain, and ad.ip.
Important Note: All fields must be enclosed in quotation marks (e.g., "your_value"). Data without quotes will fail to configure.
Encryption: The ad.password must be encrypted. Navigate to the Common tab, enter the password in the Clear text field, copy the resulting Encrypted value, and paste it into the ad.password setting.
Save and Run: Click Save configuration, then click Run now.
Note: Syncing 10,000 users takes approximately 10-15 minutes.
You will see the message: “Completed sending data to IncidentIQ.”
Creating a Scheduled Sync Task
To automate syncing, create a task in Windows Task Scheduler (accessible via Administrative Tools):
Create Task: Click Action > Create Basic Task... in the Task Scheduler window.
Task Wizard: Enter a name and description for the task, then click Next.
Trigger: Select when the task should run. We recommend running it daily (overnight) for the most accurate data. Ensure the task runs regardless of whether a user is logged in. Click Next.
Action: Select Start a Program and click Next.
Configure Program:
Program/script: Locate IncidentIQ.Connectors.MicrosoftAd.exe.
Add arguments: Enter -passwordreset.
Start in: Indicate the folder path where you unzipped the files. Click Next.
Finalize: Review settings, check Open the Properties dialog for this task when I click Finish, and click Finish.
Set Permissions & Frequency:
In the Properties window, select Run whether user is logged on or not and Run with highest privileges.
Go to the Triggers tab, click the Daily trigger.
Click the setting to repeat the task every 5 minutes for 1 day.
Click OK to complete the setup.