This article applies to TeamViewer customers with a Premium or Corporate license.
Insert ToC
The TeamViewer AD Connector (Active Directory Connector) helps administrators to create and setup TeamViewer accounts easily and centrally for all employees in a company via Active Directory without the need of adapting and using scripts and programming knowledge.
Requirements
To use this feature you need
- a valid TeamViewer Premium or Corporate license for TeamViewer
- to download the AD connector from our homepage
- an API token from the Management Console
Download the AD Connector
You can download the AD Connector from our website on our Integrations site.
Run the AD Connector
To run the program, please un-zip the file and double-click the Configure TeamViewer AD Connector.bat file.
Getting started
The TeamViewer AD Connector has two main areas such as Configuration and Scheduled task
The configuration UI provides the following features:
- Show and adapt the sync configuration.
- Validate the entered TeamViewer API token.
- Manually trigger a run of the synchronization script.
- Install/Uninstall a scheduled task to run the synchronization script automatically.
The configuration UI requires to be run with elevated user rights to be able to install and
uninstall the scheduled task. The script automatically asks for elevated rights (if required).
Configuration
These are the available configuration parameters of the TeamViewer AD Connector
| Setting |
Description |
| Api token |
The TeamViewer API access token that is used for accessing the TeamViewer company user directory. You can create the script token in the Management Console --> Edit profile --> Apps --> Create script token. You only need the permission View, create and edit users for User Management:  |
| AD groups |
The LDAP identifier (without the leading `LDAP://` protocol scheme) of the AD groups used for the synchronization.
You do not need to run the AD Connector on a Domain Controller. All computers that are part of the domain can access the list of AD groups.
|
| Language |
The two-letter language identifier used as default language for newly created TeamViewer users. For example it is used to localize the "Welcome" email.
|
| Init. Password |
The initial password used for newly created TeamViewer users.
|
| Test run |
If set to `true` the synchronization will not modify any TeamViewer user resources but instead only log the actions that would have been executed.
|
| Deactivate TeamViewer Users that are not members of the AD group |
If set to `true` TeamViewer users that are not member of the selected AD group will be disabled
|
| Include users of nested AD groups |
If set to `true` users of nested AD groups will be included
|
Scheduled task
The scheduled task will be created with the specified interval as:
...\TeamViewer\TeamViewer AD Connector
Output of the scheduled task is redirected to the specified log file location.
You can set the interval for the task as you like. The interval is currently on a hourly base.
User Synchronization Logic
The actual synchronization is done by the Invoke-Sync.ps1 script in the TeamViewerADConnector directory using the following logic:
- Users of the configured AD group that are not yet part of the configured TeamViewer company (identified by the API token) will be created with the specified initial password.
- Users of the configured AD group that are already part of the configured TeamViewer company will be updated.
- If configured, users of the TeamViewer company that are not present in the configured AD group will be deactivated.
Identification of users is done based on the email addresses.
