Upgrade Password Sync

As we add features, enhancements, and fixes to Password Sync, we'll release updates. We recommend you use the latest version of the software. Learn more

Before you begin

Make sure you're a domain administrator for your Microsoft Active Directory domain.

Important: You should upgrade Password Sync on each Active Directory server (domain controller). However, Password Sync still works correctly when domain controllers are running different versions.

Upgrade Password Sync

There are 3 ways to upgrade Password Sync: you can use the Password Sync configuration wizard or 2 different methods with the command line. When using the command line, choose whether to upgrade using the original configuration file (the one created during the initial install) or if you need to upgrade and update your configuration file in a single action.

Option 1: Upgrade using the configuration wizard (Recommended)

Do the following on each of your Active Directory servers (domain controllers):

1. Sign in to the domain controller as a domain administrator. The account must be from the domain controller’s domain.
2. Download Password Sync. Ensure you download the correct edition for your operating system (32-bit or 64-bit).
3. Run the downloaded installer.
4. Complete the installer steps.
5. Click Yes to restart your system.
6. (Optional) To verify the upgrade completed correctly:
   1. On the domain controller, click Control PanelPrograms and Features.
   2. Find Password Sync in the list and confirm the info in the Version column is correct.

Option 2: Upgrade Password Sync using the command line (Complex)

1. Sign in to the domain controller as a domain administrator. The account must be from the domain controller’s domain.
2. Download Password Sync. Ensure you download the correct edition for your operating system (32-bit or 64-bit).
3. Copy the Password Sync software to your domain controller.
4. To begin the upgrade using the previous configuration file, use the following command:

   msiexec /i passwordsync_[32|64]bit.msi /l*vx msi_log.txt /quiet

   Note: This is a single command without line breaks.

5. Restart your system.
6. (Optional) To verify the upgrade completed correctly:
   1. On the domain controller, click Control PanelPrograms and Features.
   2. Find Password Sync in the list and confirm the info in the Version column is correct.

Option 3: Upgrade Password Sync and change the configuration file in a single action on the command line (Advanced)

If you need to modify your configuration while upgrading, you can set new arguments and parameters.

Note: Make sure you're a Google Workspace super administrator for your Google Workspace organization. Only super administrators can authorize the service account required to complete a Password Sync upgrade this way.

1. Sign in to the domain controller as a domain administrator. The account must be from the domain controller’s domain.
2. Download Password Sync. Ensure you download the correct edition for your operating system (32-bit or 64-bit).
3. Copy the Password Sync software to your domain controller.
4. To begin the upgrade with the updated configuration file, build the command using the command prompt on your domain controller.

   Start with the following command and append the arguments and parameters specified in the table below. Enter the arguments with all uppercase letters and enclose the parameters in quotation marks

   msiexec /i passwordsync_[32|64]bit.msi /l*vx msi_log.txt /quiet

   Note: The final version should be a single command without line breaks.

   Argument	Parameter
   ADMIN_EMAIL	The email address of your Google administrator. Example: ADMIN_EMAIL="[e-mail]"
   BASE_DN	(Optional) Your Active Directory domain's base distinguished name (DN). When this parameter is omitted, Password Sync attempts to autodetect the base DN. Example: BASE_DN="OU=users,DC=mydomain,DC=com".
   CREDENTIALS_FILE	The full path to your service account JSON file. Note: The JSON file has a key that allows access to your Google domain. After authentication, remove the file from the system. Example: CREDENTIALS_FILE="c:\users\administrator\downloads\service_account.json"
   MAIL_ATTRIBUTE	(Optional) The Active Directory attribute that has each user's Google email address. When this parameter is omitted, Password Sync uses the default "mail" attribute. Example: MAIL_ATTRIBUTE="mail"

5. Restart your system.
6. (Optional) To verify the upgrade completed correctly:
   1. On the domain controller, click Control PanelPrograms and Features.
   2. Find Password Sync in the list and confirm the info in the Version column is correct.

Password Sync upgrade example

In this example, the administrator's address is [e-mail]. The Active Directory base DN is OU=users,DC=mydomain,DC=com. The service account's JSON file is located on the domain controller at c:\users\administrator\downloads\service_account.json. Each username is stored in Active Directory's mail attribute.

Note: This example command is a continual single line. Any line breaks visible here are for page formatting only.

msiexec /i passwordsync_64bit.msi /l*vx msi_log.txt /quiet ADMIN_EMAIL="[e-mail]" BASE_DN="OU=users,DC=mydomain,DC=com" CREDENTIALS_FILE="c:\users\administrator\downloads\service_account.json" MAIL_ATTRIBUTE="mail"

Next steps

After the upgrade successfully runs, any password changes made to a user's Active Directory account are automatically updated for your Google users as well.

To verify, change a single user's Active Directory password to make sure it syncs correctly.

If you need help with the installation, go to Troubleshoot Password Sync.

Related topics

• Set up Password Sync
• Install & configure Password Sync from the command line

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}