Adaxes Q&A - Recent questions and answers in Active Directory Management with Adaxes

Answered: Property Pattern Regex Validation Help

Wed, 11 Mar 2026 10:40:50 +0000

Hello,

Do we understand correctly that you need to actually allow only English letters and numbers? If that is correct, you can use the following regexp:

^[a-zA-Z0-9]$

Answered: How can I add users to (and remove users from) a group based on the M365 License a user has?

Wed, 11 Mar 2026 10:13:34 +0000

Hello Ray,

Unfortunately, there is no possibility to achieve that making a group rule-based. However, it can be done with the help of a scheduled task like below:

Answered: Display Name in web form

Fri, 06 Mar 2026 11:55:40 +0000

Hello,

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: Does Adaxes provide a calculated last‑logon value for AD and Entra, or must I combine properties myself?

Wed, 04 Mar 2026 12:28:03 +0000

Hello,

It looks like using the If is inactive <period> condition is exactly what you need. For details, please, have a look at the following FAQ article: https://www.adaxes.com/questions/16835/how-does-adaxes-determine-account-inactivity.

Answered: Portal Actions Referencing Moved or Invalid OUs

Wed, 04 Mar 2026 10:46:50 +0000

Hello,

Is there a way to automate this or make the criteria dynamically update when such changes occur?

Unfortunately, there is no easy way to do that. It will require quite complicated custom scripting. Also, you will need to take into account that such updates can be performed outside Adaxes.

Or do we need to manually review and update our actions each time objects are moved or restructured?

Yes, that is correct.

Additionally, is it possible to receive a notification or run a script that checks for invalid or non‑existing objects referenced in action criteria?

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: Get Entra ID / Azure AD properties for a group ...

Wed, 25 Feb 2026 10:27:30 +0000

Hello,

To obtain the identifier, you can use the below script in a custom command, business rule or scheduled task. Pay attention that it will only work on users included into the associated scope of your tenant in Adaxes.

try
{
    # Get the object ID in Microsoft 365.
    $objectId = [Guid]$Context.TargetObject.Get("adm-AzureId")
}
catch
{
    return
}

Answered: Installing Adaxes 2026.1

Mon, 23 Feb 2026 15:19:32 +0000

Hello,

The error looks to be related to your environment settings, not the permissions granted to the Adaxes service account. Most probably, it is about UAC. As an option, you can try running the installation as administrator. To do so, start command prompt as administrator and use the below command. In the command, <path_to_package> is the path to the Adaxes installation package.

msiexec /i "<path_to_package>\adaxes.msi"

Adaxes very slow and laggy after integrating EXO

Mon, 23 Feb 2026 14:39:24 +0000

After connecting to Exchange Online, we can once again access the Exchange properties of users as usual. That works well.

However, we now have relatively long loading times when calling up users, creating distribution lists, and basically everything else. It can easily take 15-20 minutes.

Is there any way to check what is taking so much time here?

We are grateful for any ideas and suggestions.

Answered: How do I display an icon in a report specific column?

Fri, 20 Feb 2026 16:14:35 +0000

Hello,

Unfortunately, there is no such possibility. An icon is something that belongs to the entire report item and it is included into the Name column. To achieve the desired, you can update the Adaxes log built-in report to only include log records for the operations performed by a specific scheduled task. By default, the report is located in container Reports\All Reports\Miscellaneous\Logging.

Answered: Multiple domain names

Fri, 20 Feb 2026 10:00:53 +0000

Hello Cas,

Please, make sure that the scope of the property pattern covers the location where you are attempting to create a new account. Also, there should be no conflicting property patterns. There must be just a single property pattern per location that determines settings for a property, username userPrincipalName) in this case.

Answered: External Contact Self-Service

Thu, 19 Feb 2026 17:28:23 +0000

Hello,

Unfortunately, there is no such possibility. Only managed users can sign in and perform operations in Adaxes.

Answered: Export of business units, find relevant membership rules

Wed, 18 Feb 2026 15:08:21 +0000

Hello,

Unfortunately, we do not have any scripts of the kind.

Answered: Trying to connect M365 with adaxes

Tue, 17 Feb 2026 10:07:21 +0000

Hello,

The error is about the permissions granted to the application in Microsoft Entra. Make sure grant all the permissions mentioned in the article and add admin consent. Pay attention that the permissions must be of application type, not delegated.

As an easy option, you can use the script from section Quick app registration with a script.

Answered: adm-CustomAttribute visibility and bulk update issues

Thu, 05 Feb 2026 13:25:14 +0000

Hello,

The behavior is by design. In such an environment extension attributes are only available when viewing Exchange properties of an object. There is no possibility to view or update them as regular properties.

As an option, you can use the import script from our repository to update Adaxes custom attributes and then set the same values to extension attributes in a business rule (exactly as in your screenshot). At the same time, you can add Adaxes custom attributes to web interface forms so that they are visible even without viewing Exchange properties. In the Administration console, the attribute values can be viewed in the result pane when selecting an object.

Answered: Is there a way to CC when sending an email without scripting

Wed, 04 Feb 2026 10:05:51 +0000

Hello,

Unfortunately, there is no such possibility. Using a PowerShell script is the only option.

Answered: How to edit "My Requests" page in Web Admin

Fri, 30 Jan 2026 09:57:58 +0000

Hello,

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

As a workaround, you can make sure that the signed in user does not have the permissions to see the approver in Adaxes.

Answered: Is there a way to revoke Okta Tokens using an Adaxes Call

Thu, 22 Jan 2026 14:04:32 +0000

Hello William,

Thank you for clarifying. That is something that can only be done using a custom script if Okta supports such requests at all. Unfortunately, we do not have anything like that.

Default domain isn't available, users need to click sign in options then the key icon to login to our domain

Mon, 19 Jan 2026 10:12:42 +0000

After installing the self-service client MSI, at the Windows login screen, when clicking other user, the default domain isn't available, users need to click sign in options then the key icon to login to our domain When I uninstall the self-service client, the domain for other user is immediately available. I've even updated a GPO to add our default login domain and this is applied but with Self-Service client installed not showing by default.

Answered: AAD group user removal

Thu, 15 Jan 2026 10:04:35 +0000

Hello,

Yes, you need to register your Microsoft Entra domain in Adaxes. The following article will be helpful: https://www.adaxes.com/help/RegisterUnregisterManagedDomain. On step 5 of the guide, select Microsoft Entra domain. You can use the same app credentials as for the Microsoft 365 tenant registration. Once done, the script should remove accounts from both on-premises AD and Microsoft Entra groups.

Answered: Is there any timeline for getting rid of AD as a dependency?

Thu, 15 Jan 2026 10:01:41 +0000

Hello,

The feature is on our TODO list, but there is currently no ETA for it at all.

Answered: Remove user from a group

Tue, 13 Jan 2026 16:20:07 +0000

Hello,

Thank you for the provided details. The first approach should work fine, but it might be required to add the -Server parameter:

Remove-AdmGroupMember -Identity "%sAMAccountName%" -Members "%adm-InitiatorDN%" -confirm:$false -AdaxesService localhost -Server "dc.domain.com"

Also, you can use the below approach that will definitely work.

$Context.TargetObject.Remove("Adaxes://%adm-InitiatorDN%")

Answered: Approvals: You are not allowed to deny this request.

Mon, 12 Jan 2026 13:36:54 +0000

Hello,

Thank you for the provided details. Unfortunately, it is an issue in Adaxes. We forwarded the details to the corresponding department for consideration. As of now, you can resolve the issue by replacing this line in your script

$request = $Context.BindToObjectEx("Adaxes://<GUID=$guid>", $True)

with the following one

$request = $Context.BindToObject("Adaxes://<GUID=$guid>")

Custom report to show Secretaries and who they support

Fri, 09 Jan 2026 09:29:45 +0000

I am trying to create a custom report which lists all secretaries and whom they support, I have a working report except for when there are multiple secretaries supporting a user it is displaying them as multiple values on the same row and the report specific column is presenting an error due to the unexpected multi value being passed to it.

I have created a directory search report and added the columns Secretary, Secretary Object GUID (report specific column), Name, and Object GUID.

The report specific column appears to be working where there are single secretaries assigned but when trying to export the report it fails because multiple values are being passed to the report specific column, specifically the error is "Exception calling BindToObjectByDN - Cannot parse ADsPath String, line 8". The PowerShell is:

$obj = $Context.GetDirectoryObject() try { $secretaryDN = $obj.Get("secretary") $secretary = $Context.BindToObjectByDN($secretaryDN) $Context.Value = $secretary.Get("ObjectGUID") } catch [System.Runtime.InteropServices.COMException] { }

Is it possible to separate out multiple Secretary values to their own lines?

I am wanting to export a CSV containing: Secretary (displayName), Secretary (Object GUID), User (displayName), User (Object GUID)

The CSV should have a line for each person a secretary supports and where there are multiple values then that should be separated out so each secretary would have its own row.

For example:

Secreatry	Object Guid	User	Object Guid
Jane	1234567	Steven	32132331
Jane	1234567	Alice	4324523
Paul	234572	Steven	32132331
Paul	234572	Michael	58745646
Paul	234572	Alice	4324523
Mary	95723272	Lara	0937546732
Mary	95723272	Kathy	932742

In the above, Jane and Paul look after Steven and Alice and currently appear as multiple values and need to be separated out.

Answered: Adaxes Powershell not getting values of Custom Attributes

Mon, 05 Jan 2026 09:51:59 +0000

Hello,

First of all, you need to specify the schema name of the property in the cmdlet, not a value reference to the property. Additionally, to get the values of Adaxes custom attributes, you need to specify the -AdaxesService parameter when using cmdlets from the Adaxes PowerShell module. Finally, to get a value of the adm-CustomAttributeText3 property, the command should look like this:

Get-AdmOrganizationalUnit -Identity "OU=Test City Adaxes,OU=City Users,DC=Company,DC=ORG" -AdaxesService "adaxes.domain.com" -Properties "adm-CustomAttributeText3" | Select-Object "adm-CustomAttributeText3"

Answered: Script Failed

Tue, 16 Dec 2025 15:46:31 +0000

Hello,

Unfortunately, the approach you are using is overcomplicated and hardly usable. As an option, you can create a scheduled task configured for the User object type. For each user the task will execute a PowerShell script that will obtain values just like the report script and save them to Adaxes custom attributes. The following article should be helpful in writing the script: https://adaxes.com/sdk/ServerSideScripting.

Adaxes doesnt seem to pick up on-prem AD account with Cloud Mailbox

Mon, 15 Dec 2025 15:55:12 +0000

I see the following error when I navigate to the user:

The operation couldn't be performed because object '[user] ' couldn't be found on '[local DC]'.

We have Adaxes configured to at least partially manage M365, but I assume its missing some permissions. Any idea what it could be?

Answered: Custom Attribute Management

Wed, 10 Dec 2025 17:50:25 +0000

Hello,

Type is a column, not a property name. That is why it is only available in lists (reports, objects in an OU, etc.) and not on object view properties. At the same time, there is no such property that will only display a certain type of object. You can use the Object class one, but each object has multiple values in it (e.g. for a user it will be top, person, organizationalPerson, user). If you need to display just a single value (e.g. User for user accounts), it can be done using a custom text attribute (e.g. CustomAttributeText1) populated accordingly. For example, it can be done using a scheduled task like below (you will need a separate task for each type of objects). For details on how to make the property visible on a web interface form, see https://www.adaxes.com/help/CustomizeFormsForUserCreationAndEditing.

Unfortunately, there is no dedicated property holding the current enrollment status of a user for password self-service. You can save the status to a custom Boolean attribute using this script and add the attribute to the user view form.

Answered: Incorrect email address after licensing a user in Office 365

Tue, 09 Dec 2025 10:22:59 +0000

Hello Allister,

There is nothing in Adaxes itself that might do such a thing unless specifically configured. Do we understand that the process in Adaxes automatically enables a remote mailbox as well? If that is correct, on-premises Exchange can update the Email property with the primary SMTP address and that will get synchronized to Microsoft Entra. The behavior is by design in Exchange and is not related to Adaxes. To work around that, update your business rule as follows:

Answered: Remove all members in a group.

Tue, 02 Dec 2025 14:01:31 +0000

Hello,

You can use the following script from our repository: https://www.adaxes.com/script-repository/remove-all-group-memberships-for-a-user-account-s33.htm. Pay attention that it is impossible to remote a user from Microsoft Entra dynamic groups (corresponding rules in the group settings must be updated), Adaxes rule-based groups (membership rules must be updated) and the primary AD group. The behavior is by design and cannot be worked around.

Answered: Criteria for Actions in web interface

Tue, 25 Nov 2025 10:52:06 +0000

Hello,

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: Logging Database Column typo

Wed, 19 Nov 2025 11:17:56 +0000

Hello,

Thank you for pointing out the issue. We forwarded the details to the corresponding department.

Answered: How can I authenticate against Exchange Online using service principal?

Tue, 18 Nov 2025 13:12:42 +0000

Hello,

Unfortunately, there is no such possibility. Using method $Context.CloudServices.ConnectExchangeOnline() is the only option in Adaxes scripts. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: "Failed to create a remote mailbox for the user" when enabling Exchange Online license

Tue, 18 Nov 2025 12:13:36 +0000

Hello Allister,

Thank you for the provided details. The $tenantDN variable value is incorrect. It must be like below. To get the proper value, make sure to follow precisely the steps from the variable description (looks like you missed steps 6 and 7).

CN=My Tenant,CN=Office 365,CN=Cloud Services,CN=Configuration Objects,CN=Adaxes Configuration,CN=Adaxes

Also, you are using an old build of Adaxes 2025.1 that has known issues. We recommend upgrading to Adaxes 2025.1 Update 4.

Upgrade instructions

What’s New

Answered: How to force use of newer ExchangeOnlineManagement module version?

Tue, 18 Nov 2025 10:08:16 +0000

Hello,

Unfortunately, there is no such possibility. Adaxes only uses the version of the ExchangeOnlineManagement PowerShell module that it installs. For your information, Adaxes 2025.1 Update 4 uses ExchangeOnlineManagement version 3.8.0.

Answered: Generate Report of Groups that includes a Member's Value

Fri, 14 Nov 2025 16:05:27 +0000

Hello,

As long as you want to check properties of group members and then output the groups themselves into the report, the only option is to use a script to generate the report. The approach used to perform the search (using property AttributeScopeQuery) in the following script should be helpful: https://www.adaxes.com/script-repository/add-members-of-the-target-group-to-the-specified-one-s661.htm.

Answered: multiline report value?

Fri, 14 Nov 2025 09:54:36 +0000

Hello,

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: Is it possible to let users download report as a file?

Fri, 14 Nov 2025 09:41:37 +0000

Hello,

Unfortunately, there is no such possibility with reports. You can make your script save the report as a file and have it executed in a custom command.

Answered: How to add group members directly from a report?

Thu, 13 Nov 2025 15:24:28 +0000

Hello,

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration. As a solution, you can use the following approach:

Create a custom command with the Only remove from all groups script from following article: https://www.adaxes.com/script-repository/remove-all-group-memberships-for-a-user-account-s33.htm.
Execute the custom command for the required group.
Generate the report.
Select all the members in a report and add them to the group.

As another option, you can create a custom command with a PowerShell script that will find accounts according to the required criteria and replace all the current members of the group with the found ones.

Answered: Approvals (AD vs Entra)

Thu, 13 Nov 2025 10:16:13 +0000

Hello Daniel,

The feature was introduced in Adaxes 2025.1. If an on-premises user logs in into Adaxes and there are existing approval requests where the synchronized Microsoft Entra account is approver, the requests will be displayed.

Answered: Self-Service Contacts

Mon, 10 Nov 2025 16:07:08 +0000

Hello,

Thank you for clarifying. As the user and the contact account have the same email in your Active Directory, you can use the following approach:

Create a scheduled task like below that will set the Assistant property of the target user to the distinguished name of the contact.
Grant user the permissions to modify membership of the required groups: https://www.adaxes.com/help/GrantRightsToModifyGroupMembership.
Create a web interface action of the Add to group type that will be configured to only add the contact specified in the Assistant property of the initiator to the selected group. The following tutorial will be helpful: https://www.adaxes.com/help/ConfigureActionsPane/.
If necessary, create a business rule triggering Before adding a member to a group that will cancel the operation for certain initiators if they try to add any member except for their contact. It will look like the following:

Answered: Can't create AD account username FNLN@domain.com. I keep getting incorrect peramiters

Thu, 06 Nov 2025 10:35:09 +0000

Hello,

The following tutorial should be helpful: https://www.adaxes.com/help/AutomateUserProvisioning. If that is not what you need, please, describe the current workflow and the changes you need to make in all the possible details with live examples and screenshots. You can post them here or send to us at support@adaxes.com.

Answered: Does 2025.1 support different roots or multiple hostnames (on a single server)?

Wed, 05 Nov 2025 17:03:49 +0000

Hello,

For details on how to expose Adaxes web interface to the Internet, have a look at the corresponding section of the installation guide: https://www.adaxes.com/help/InstallationGuide/#exposing-web-interface-to-the-internet. On the server where the web interface will be installed, you can allow only a specific one for access. To configure that, use the Web servers functionality in the Access Control section of the web interface configurator.

Answered: Web Interface Tutorial not working

Tue, 04 Nov 2025 22:04:20 +0000

Hello,

Thank you for pointing out the issue. We forwarded the details to the corresponding department and apologize for the inconvenience.

Answered: Logging MsSQL - OperationExecutionLog

Wed, 29 Oct 2025 17:07:50 +0000

Hello,

The Operation Execution Log column contains byte arrays. Each of them is a string in UTF-8 encoding. The string contains an XML representation of the execution log. Unfortunately, we do not have a script that extracts and formats the data.

Answered: Logging Syslog - Execution Log

Mon, 27 Oct 2025 12:19:00 +0000

Hello,

Unfortunately, there is no such possibility. As of now, only the operation description and result (Success, Pending or failure error) are included. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: Self-Service Business Rules and Operations issues

Mon, 27 Oct 2025 10:28:19 +0000

Hello,

For some reason, when I self reset with "Forgot Password" in the self service portal, it first sets "Must Change Password" to yes, and then to no. I know it's setting it to know because of the business rule from #1, but not sure why it starts by setting it to yes

It is expected that both business rule trigger in this case. At the same time, as the rules have different triggering operations, there is no possibility to specify an execution order. If you want the rule triggering After resetting password of a user to only fire when the reset is performed by a different user, you can configure the rule as follows:

And when I am signed into the portal after self service and click "Change Password" it doesn't run any business rule. I can't find any Operation that is "Change own password"

You can have a business rule triggering Before/After changing password of a user.

Answered: How to manage Microsoft LDA File folder security and permissions from Adaxes?

Wed, 22 Oct 2025 09:14:58 +0000

Hello,

Unfortunately, there is no such possibility. However, thank you for the suggestion. We forwarded it to the corresponding department for consideration.

Answered: remove-admgroupmember not working for members in other domains

Fri, 17 Oct 2025 12:49:01 +0000

Hello Felix,

Unfortunately, this is a known issue in Adaxes 2025.1. We will fix it in one of the future releases. Sorry for the inconvenience. As a workaround, you can use the ADSI approach. For examples, have a look at the following article: https://adaxes.com/sdk/SampleScripts.AddingAndRemovingGroupMembers.

Answered: Generating Report of Users with Forwarding Activated and who the mail is being forwarded to

Wed, 15 Oct 2025 15:46:59 +0000

Hello Gareth,

Thank you for specifying. You can find the script for the report below. In the script:

$forwardedUserColumnID - Specifies the identifier of the custom column that will contain the Forward to account. The column must be of the Directory object type.
$fullAccessUserColumnID- Specifies the identifier of the custom column that will contain the accounts that have full access permissions over the mailbox. The column must be of the Text type.

# Custom column identifiers
$forwardedUserColumnID = "{4a7d1b39-bfb6-4935-a3e8-a36aaf57294d}" # TODO: modify me
$fullAccessUserColumnID = "{a2a66ae6-bc5b-423a-9c5f-ddb460b20710}" # TODO: modify me

# Build citeria
$criteria = New-AdmCriteria "adm-LinkedMailbox", "adm-PublicFolderMailbox", "user" {mailboxType -ne "none"}
$Context.DirectorySearcher.AddCriteria($criteria)

try
{
    # Execute search
    $searchResultIterator = $Context.DirectorySearcher.ExecuteSearch()
    $searchResults = $searchResultIterator.FetchAll()    
}
finally
{
    # Release resources
    if ($searchResultIterator){ $searchResultIterator.Dispose() }
}

foreach ($searchResult in $searchResults)
{
    $user = $context.BindToObjectBySearchResult($searchResult)

    try
    {
        # Get forward to
        $mailboxParams = $user.GetMailParameters()
        $deliveryOptions = $mailboxParams.MailFlowSettings.DeliveryOptions
        $forwardToGUID = $deliveryOptions.ForwardingAddress.ObjectGUID

        if ($NULL -eq $forwardToGUID)
        {
            continue
        }
        $forwardToColumnValue = $Context.BindToObject("Adaxes://<GUID=$forwardToGUID>")

        # Get Full Access permissions
        $objectReferences = $mailboxParams.MailboxRights.GetTrusteesGrantedRights("ADM_EXCHANGE_MAILBOX_RIGHTS_FULL_ACCESS")
        $fullAccessDisplayNames = @()

        foreach ($objectReference in $objectReferences)
        {
            $sid = $objectReference.ObjectSid
            if ([System.String]::IsNullOrEmpty($sid))
            {
                continue
            }
            elseif ([Softerra.Adaxes.Utils.WellKnownSecurityPrincipalInfo]::IsWellKnown($sid))
            {
                continue
            }

            # Get object display name
            try
            {
                # Bind to object
                $object = $Context.BindToObject("Adaxes://<SID=$sid>")
                $displayName = $object.Get("displayName")
                $fullAccessDisplayNames += $displayName
            }
            catch
            {
                continue
            }            
        }

        $fullAccessColumnValue = [System.String]::Join(";", $fullAccessDisplayNames)
        $columnValues = @{$forwardedUserColumnID = $forwardToColumnValue.Get("distinguishedName"); $fullAccessUserColumnID = $fullAccessColumnValue}
        $Context.Items.Add($searchResult, $columnValues, $NULL)
    }
    catch
    {
        continue
    }
}

Answered: Failed to Connect to Service Configuration Server

Tue, 14 Oct 2025 09:18:21 +0000

Hello,

First of all, make sure that all the ports used by Adaxes are open for the computer where the new Adaxes service will be installed. For details, see https://www.adaxes.com/questions/20/what-ports-does-adaxes-use.

Also, you need to make sure that all the ports for AD LDS (used as Adaxes backend) replication are also open. For details on the ports, have a look at the following Microsoft article: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN.

Pay attention that not only firewall, but some third-party software (e.g. protection one) can block or consume the ports.

Finally, make sure that the account you specify during the installation is not a member of the Protected users group.