Hybrid AD Manager: User Guide

Hybrid AD Manager brings Active Directory Users and Computers, Sites and Services, Domains and Trusts, DNS, Group Policy Management and Entra ID into one browser page that looks and behaves like the consoles you know. If you can use ADUC, you can use this. This guide covers what is different and what is new.

1. Signing in

Open the console URL and choose Active Directory. Use your own account, as user@domain or DOMAIN\user. Everything you then do runs as you, with exactly your permissions, and is recorded in the audit log under your name. Entra ID signs in through your Microsoft account. The Local account tab is for the console's own administrator and only reaches the Settings pages.

Each Active Directory or Entra ID sign-in takes one licence seat until you sign out, the session expires, or an administrator disconnects it. If all seats are taken the sign-in is refused with a message saying so.

2. The console

The window is laid out like an MMC console: a title bar with the product version, a menu bar, a tree on the left and a list on the right, with a status line at the bottom.

Tab View or Combined View (View menu). Tab View, the default, shows one tool at a time with a tab for each down the left edge. Combined View shows every tool in one tree under Console Root. Both remember your choice per browser. A tool that is not in your licence shows a red mark on its tab.

Domain picker, in the menu bar next to Help, appears when more than one domain is configured and switches the whole console between them.

Menus. File holds Settings, Sessions, Audit log, API tokens, Licence and Sign out. Action opens the actions for the item selected in the tree, the same ones as a right-click. View chooses the layout, which tools are shown, Advanced Features, and the phone layout. Help has About.

Right-click anywhere you would in the Windows consoles: tree items, list rows, empty space in a list.

Find (magnifier, or Ctrl+F) searches the whole domain by name, logon name, UPN or e-mail, plus cloud-only users.

Badges. In the identity column every user carries a coloured dot: green synced (exists on-premises and in Entra ID, linked by ms-DS-ConsistencyGuid), blue cloud-only, amber on-prem only. Edits to a synced account are made on-premises and appear in the cloud after the next sync cycle; the console says so where it applies.

3. Users and Computers

The tree shows the domain with its OUs and containers. Advanced Features (View menu) reveals System, LostAndFound and the other hidden containers, as in ADUC.

New objects. Right-click an OU: New User, Group, Organizational Unit or Computer. The user dialog has the same two pages as ADUC (name and logon, then password and options).

Properties. Double-click or right-click, Properties. The sheets carry the ADUC tabs:

• User: General, Address, Account, Profile, Telephones, Organization, Member Of, Delegation (when the account has service principal names), Dial-in, Published Certificates, Object, Security, Entra ID, Attribute Editor.
• Group: General, Members, Member Of, Managed By, Object, Security, Attribute Editor.
• Computer: General, Operating System, Member Of, Delegation, Location, Managed By, Dial-in, Object, Security, Attribute Editor.
• OU and Contact: their ADUC tabs, plus Security and Attribute Editor.

OK saves and closes; Apply saves; every field maps to one directory attribute. The Attribute Editor tab shows every attribute with its syntax, like ADSI Edit.

Account actions. Right-click a user: Reset password, Disable or Enable, Unlock, Add to a group, Move, Rename, Delete, Copy distinguished name. Reset password can require a change at next logon and unlock at the same time.

Security tab. The permissions on the object. The first view lists the principals and, for the selected one, Allow and Deny boxes for the standard rights and every extended right that applies to that class. Inherited entries show greyed. Advanced opens the full entry list with owner, inheritance and the ability to add, edit or remove entries down to individual attributes. Changing permissions needs the Administrator console role, and, as always, the directory rights to do it.

The Entra ID tab on a user shows how the on-premises and cloud objects are linked, the cloud object ID, and anything the console found doubtful about the match.

4. Entra ID

The Entra ID tool lists cloud users and groups. Cloud-only users can be created, blocked, edited, have their password reset and be deleted from the right-click menu; groups can be created and deleted and their members added and removed. Anything synced from on-premises is changed on the Users and Computers side, and the console says so rather than letting you make a change the next sync would undo. Cloud changes run through the app registration and need its write permissions (see the Installation Guide).

5. Sites and Services

Sites, subnets, site links, bridges, servers and their NTDS Settings, laid out as in the Windows console. Right-click for New Site, New Subnet, New Site Link, New Site Link Bridge, Move a server to another site, Rename and Delete. Properties edit cost, replication interval, site membership, a subnet's site, and the usual options. Sites live in the forest's Configuration partition, so deleting one needs Enterprise Admins, exactly as in the Windows console.

6. DNS

Zones from the DNS application partitions, with their records. A zone's Properties sheet edits the SOA and name servers. Right-click in a zone's record list to add A, AAAA, CNAME, MX, TXT, SRV, PTR and NS records, edit or delete them. Records take effect on the DC immediately and replicate with the partition.

7. Group Policy Management

The forest, its domains and OUs, and the Group Policy Objects container. Selecting a domain or OU shows the GPOs linked there in link order. Right-click in that list to link an existing GPO or block inheritance; right-click a link for Enforced, Link Enabled, Move Up and Down, and Delete Link. In the GPO list: New GPO, Rename, Delete, and Copy the SYSVOL path. Creating a GPO also creates its SYSVOL folder, which needs the console to run on Windows. Editing the settings inside a GPO (the policy editor) is not part of this version; open it in GPMC from the SYSVOL path shown.

8. Domains and Trusts

The forest and domain functional levels, the FSMO role holders, and every trust with its direction, type, transitivity and SID-filtering state.

9. Phone layout

On a phone or tablet the console switches to a search-first, single-column layout for helpdesk use: search, open a user, see their status and groups, and run the common actions. View, Phone layout forces it on a desktop; the button at the top returns to the full console.

10. Administration pages

Under the user menu or File:

• Settings. The same five steps as the wizard, editable at any time, plus More domains.
• Sessions. Who is signed in, how, since when, from where, and whether they hold a licence seat. Disconnect ends a session at once.
• Licence. What the licence allows, this server's Installation ID and Domain SID (keys are issued for one installation in one domain and only work there), and where to paste a new key. The page has a link that starts a licence request by email with the ID filled in.
• Audit log. Every sign-in, read and change, by day and by actor, with what changed but never the values of secrets.
• API tokens. Personal tokens for scripts. A token can never do more than the person who created it.

11. Roles at a glance

Role	Can
Reader	Browse every tool, open property sheets, search, read their own audit entries
Operator	Everything Reader can, plus create, change, move, rename and delete objects, DNS records, sites and GPO links
Administrator	Everything Operator can, plus change permissions, manage the licence, sessions and settings

The directory's own permissions always apply on top: the console shows what your account can see and refuses what your account cannot do, with the directory's own reason.