It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Content Shield

How to Get and Configure the Barracuda Active Directory Sync Tool

  • Last updated on

The Barracuda Active Directory Sync Tool can be installed either on an AD server or  on a device that has direct access to the AD server.  The tool periodically checks the domain controller for changed user and group information as well as group memberships.

  • The tool supports nested groups within a single domain.
  • The tool does not support cyclical groups, such as 'Group A is a member of group B, and group B is a member of group A. '
  • Only one instance of the tool should be run a single customer environment.

System Requirements

Before configuring the Barracuda Active Directory Sync Tool, make sure that your system meets the following requirements:

  • Local Installation – Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2 or 2016. Windows Server Core is not supported for local installation and monitoring. The Active Directory Sync Tool can, however, communicate with a domain controller that is running Windows Server Core. In this case, you could install the Active Directory Sync Tool on a server running Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, or 2016 and configure it to remotely monitor a domain controller that is running on a Windows Server Core machine.

  • Remote Installation – Microsoft Windows 2008 and higher. Also note that, for the remote installation of Active Directory Sync Tool, you MUST be a domain member to query the server.  

How the Tool Works

The  Active Directory Sync Tool discovers groups and users on a customer Active Directory (AD) server by starting queries from Base Distinguished Names (Base DN). With version 1.1 and above, the Base DN controls where the agent starts querying for users. All queries start at the base and retrieve all of the users or groups below that base name recursively.

Best Practices:

  • Use the base root OU (organizational unit) if possible.
  • Specify the users and group Base DN to limit the number of groups and users to sync – this limits the (number of) requests
  • Barracuda STRONGLY recommends configuring the tool to run with a single profile, with the Search Root of the domain as the value for both the User Base DN and Group Base DN. The tool tries not to configure groups that have no users.
  • BCS supports up to a maximum of 100 groups per user.


The configuration application sets the two base DN values to to the "Search Root" of the domain that authenticated the user running the configuration application.

There are separate values for the group and user Base DN's because some AD's have accumulated multiple organization units (OU), or high level groups,  over time due to merger activity or AD upgrades. The obsolete users are isolated to a different Base DN than the currently active users. In the alternative, the current users are in a Base DN below the Search Root. Searching for users below the Base DN does work, but many of the important AD group objects are located under the Search Root. These groups include all of the Builtin groups, Administrators, Domain Administrators, Users, Guests, and Domain Users. Therefore, the tool needs a Group Base DN value.

Synchronization Time Frames

Full synchronization refers to the time frame for retrieving objects from Active Directory (AD). Full synchronization means that all configured AD objects will be queried since the beginning of time. Otherwise, the Active Directory Sync Tool queries for AD objects since the most recent update. See below for this option.

The Active Directory Sync Tool queries every three hours.

Forcing Complete Synchronization

When setting up Active Directory Sync Tool the first time, some trial and error may be required. When adjusting the settings in the Active Directory Sync Tool relative to Active Directory (server, Base DN, etc.), it is important to establish a new baseline on the computer and, possibly, on the BCS Portal.  

The Active Directory Sync Tool user interface has an option to re-send all data from AD to the BCS Portal. This option is on the profile screen (where the server name is set) and is turned off after a synchronization cycle. After adjusting an AD setting, Barracuda Networks recommends checking the Full synchronization on Next Run box before the next run. If you do not want to wait for three hours, the Active Directory Sync Tool can be manually restarted from the service controller. The setting for Full Synchronization is on the main screen of the configuration tool:

Force Sync Setting.png

Get and Install the Barracuda Active Directory Sync Tool for BCS

  1. Log into your BCS account.
  2. Go to the USERS page and click on Directory Sync Tool.
  3. Follow instructions on the page to download and install the tool and the configuration (key) file (bcs.key) on your computer.
  4. Run the  Active Directory Sync Tool on your Windows machine.

Configuration with Multiple Base DN's

It is possible to configure multiple Base DN (even servers) within a single agent:


Use this technique to carefully pick which portions of the AD hierarchy will be synced. Barracuda Networks strongly recommends configuring as many User Base DN's as needed, and to always use the Search Root as the Group Base DN.


Base Distinguished Name from Powershell

The Base Distinguished Name on the configuration screen is the starting point for all LDAP queries made by the Barracuda Active Directory Sync Tool. In general, it should be set to the search root of the domain. Use the following commands in PowerShell to find the search root. The search root can be found using the following procedure:

  1. Logon to a domain-connected computer as a domain administrator (this might work as a domain user, but I did not test).
  2. Start a Powershell command prompt.
  3. $adsisearcher = New-Object system.directoryservices.directorysearcher
    to create an Active Directory searcher object
  4. $adsisearcher
    to verify that the object was created successfully
  5. $adsisearcher.SearchRoot
    to see the distinguished name

How to Uninstall the Barracuda Active Directory Sync Tool

Use the Add/Remove Programs or Programs and Features tool in the Windows Control Panel to uninstall the Barracuda Active Directory Sync Tool for BCS.