Hybrid AD Manager

Hybrid AD Manager: Installation Guide

Hybrid AD Manager is a web console for Active Directory and Entra ID that replaces the RSAT snap-ins with one browser page. It runs as a Windows service on a domain controller or any member server, and admins use it from any browser. This guide takes a new installation from the download to the first sign-in. The User Guide covers day-to-day use.

1. Before you start

Server. Windows Server 2019 or later (Server Core is fine). 2 CPU cores and 2 GB of RAM are plenty; the console keeps no database. One server serves any number of admins.

Network. The server must reach a domain controller of every domain it will manage over LDAPS (TCP 636) or LDAP with StartTLS (TCP 389). Admins reach the console on TCP 5080 (HTTP by default; see HTTPS). For Entra ID, the server needs outbound HTTPS to Microsoft Graph.

Domain controllers must offer TLS. A DC with a certificate from an enterprise CA already does. A lab DC without one needs a certificate in its computer store; the console refuses to send a password over a cleartext connection.

Accounts. Admins sign in with their own Active Directory accounts and the console acts as them, so no service account is needed for them. A service account is only used for sessions that have no directory password of their own: Entra ID sign-in and API tokens. Read-only rights are enough for it.

Browser. Any current Edge, Chrome, Firefox or Safari. Phones and tablets get a search-first layout.

2. Install on Windows

  1. Copy HybridAdManager-<version>.msi to the server.

  2. From an elevated PowerShell:

    msiexec /i C:\Temp\HybridAdManager-1.0.53.msi

    For an unattended install add /qn /norestart. Deployment tools can use the same command.

  3. The installer registers the HybridAdManager service (runs as Local Service, starts automatically, restarts on failure), opens TCP 5080 in Windows Firewall, and creates C:\ProgramData\HybridAd for settings, keys, licence and audit logs. Program files go to C:\Program Files\HybridAd.

  4. Read the one-time setup token: Start Menu, Hybrid AD Manager setup token, or

    Get-Content C:\ProgramData\HybridAd\setup-token.txt

The service listens on every interface from the first start, so the wizard can be opened from another machine; Server Core has no browser of its own.

3. First-run wizard

Open http://<server>:5080. The wizard runs once and has five steps; each is saved as you go, so you can close the browser and come back.

  1. Setup token. Paste the token from step 2 or 3. It proves you are the person who installed the software and is discarded when setup completes.
  2. Administrator. Create the local console account. It maintains the console itself (Settings, Licence, Sessions, Audit) and never sees the directory, so it does not use a licence seat. Passwords need 12 characters with mixed case, digits and a symbol; the page says which rule is unmet.
  3. Directory. On a domain-joined server the console finds its own domain controller and fills in the name and port; confirm it. Otherwise enter the DC's DNS name. Untick certificate validation only for a lab DC with a self-signed certificate. "Test" tries the connection, optionally with your own account; nothing typed there is stored. The service account is optional (see section 1).
  4. Entra ID (optional). Tenant ID and the application ID of an app registration that authenticates with a certificate and holds the application permissions User.Read.All, Group.Read.All, Device.Read.All and Organization.Read.All with admin consent. Add User.ReadWrite.All and Group.ReadWrite.All to create and change cloud objects. Leave blank to skip; it can be added later in Settings.
  5. Sign-in and roles. Which sign-in methods to allow and which groups map to the three console roles: Administrator (everything, including permissions), Operator (day-to-day changes), Reader (browse only). Group names or distinguished names; * under Readers admits any signed-in domain user.

Finish, then sign in with Active Directory and your own account.

4. Licence

A fresh install runs the free edition: every tool, read-only, one signed-in user, and lists capped at 15 items. Under the user menu, Licence, the page shows this server's Installation ID and the Domain SID of the domain it manages. Send both with your order (the page has a "Request a licence by email" link that fills it in); the key you receive is issued for that installation and domain and will not install anywhere else. Paste the key on the same page. The key states the edition, number of concurrent signed-in users (seats), number of domains and tenants, and which tools it includes. Keys are verified offline; no internet access is needed.

A licence runs for 12 months from the date it is issued and does not renew by itself. For the last 30 days of the term the console's title bar shows how many days remain; order a new key from the vendor's site (the Licence page links to it) and paste it over the old one. If the key lapses there is a 30-day grace period during which writes still work, after which the console is read-only until a key is installed.

The Installation ID comes from the server's Windows machine identity, so reinstalling the application or restoring the data folder on the same server keeps it. A new or rebuilt server has a new ID and needs a replacement key; contact the vendor with the new ID.

5. Adding domains

Settings, Directory, More domains. Add a domain controller for each further domain, within the licence's domain count. Admins sign in once with the account of any configured domain; the Domain picker in the menu bar switches the console between domains. Reads and changes in another domain run with the signed-in account, so a trust is needed and the account must hold rights there.

6. HTTPS for the console

The console starts on HTTP so the wizard works before any certificate exists. For production, put a certificate on it: in settings.json under Listener, set CertificatePemPath and CertificateKeyPath (or CertificateThumbprint on Windows) and restart the service. Alternatively place a reverse proxy such as IIS or nginx in front of port 5080 and terminate TLS there.

7. Upgrading

Run the newer installer over the existing one. On Windows:

msiexec /i C:\Temp\HybridAdManager-<newer>.msi /qn /norestart

Settings, keys, licence, audit logs, API tokens and sessions are kept. The version shows in the title bar and under Help, About; a higher number is always newer. To roll back, install the previous package the same way.

8. Uninstalling

Apps and Features, or msiexec /x <msi>. Data in C:\ProgramData\HybridAd is kept; delete it by hand for a clean slate.

9. If something goes wrong