This article applies to TeamViewer customers with a Premium, Corporate, or Enterprise license.
The TeamViewer Active Directory Connector (AD Connector) helps administrators to create and setup TeamViewer accounts easily and centrally for all employees in a company via Active Directory without the need of adapting and using scripts and programming knowledge.
To use this feature you need
You can download the AD Connector from our website here.
To run the program, please un-zip the file and double-click the Configure TeamViewer AD Connector.bat file.
The TeamViewer AD Connector has two main areas such as Configuration and Scheduled task.
The configuration UI provides the following features:
The configuration UI requires to be run with elevated user rights to be able to install and
uninstall the scheduled task. The script automatically asks for elevated rights (if required).
These are the available configuration parameters of the TeamViewer AD Connector
The TeamViewer API access token that is used for accessing the TeamViewer company user management. You can create the script token in the Management Console --> Edit profile --> Apps --> Create script token. You only need the permission View, create and edit users and admins for User Management:
If you also want to deactivate admin accounts (be careful, because you could also by accident deactivate the API Token owner), you additionally need the permission View full profile for Account Management:
The LDAP identifier (without the leading `LDAP://` protocol scheme) of the AD groups used for the synchronization.
You do not need to run the AD Connector on a Domain Controller. All computers that are part of the domain can access the list of AD groups.
If set to `true` the synchronization will not modify any TeamViewer user resources but instead only log the actions that would have been executed.
|Deactivate TeamViewer Users that are not members of the AD group||
If set to `true` TeamViewer users that are not a member of the selected AD group will be disabled.
|Include users of nested AD groups||
If set to `true` users of nested AD groups will be included.
|Include secondary email addresses for synchronization||
If set to `true` secondary email addresses will be included.
The two-letter language identifier used as the default language for newly created TeamViewer users. For example, it is used to localize the "Welcome" email.
|Create accounts with predefined password||
The initial password used for newly created TeamViewer users to be changed by the user when logging in the first time.
|Create accounts with generated password||
A random password will be generated by the system. A password reset mail will be sent to the user automatically so that the user can change the password.
|Use Single Sign-On||
Users can login with via SSO. The admin needs to add the Identifier he got whilst activating SSO for your company.
The scheduled task will be created with the specified interval as:
...\TeamViewer\TeamViewer AD Connector
The output of the scheduled task is redirected to the specified log file location.
You can set the interval for the task as you like. The interval is currently on an hourly base.
You might need to modify the user in order to have the necessary execution permissions for the scheduled task. To change the user of the scheduled task:
The actual synchronization is done by the Invoke-Sync.ps1 script in the TeamViewerADConnector directory using the following logic:
Identification of users is done based on the email addresses.