You can use EasyEntra to manage any Active Directory – even if your PC is not joined with the domain.
This may be the case if your PC is Entra joined or if you want to manage multiple ADs in a single EasyEntra instance – a powerful and unparalleled capability of EasyEntra.
Follow these instructions to set up EasyEntra on a non-domain-joined PC.
Check Your DNS Settings
Before setting up EasyEntra, you should ensure that your PC can fully resolve the DC and EntraConnect Server (optional):
A simple solution is to configure the local Hosts file (C:\Windows\System32\drivers\etc\Hosts) to include the Domain Controller FQDN, the domain FQDN, and the Entra Connect Server FQDN (if you wish to be able to trigger a remote delta synchronization from EasyEntra in the remote domain).
Alternatively, your client PC must use DNS servers from the on-premises AD or use DNS servers that are integrated with (forwarding to) the on-premises AD DNS servers.
In this guide, we’ll use FQDNs to eliminate the need for additional DNS search suffix list configuration.
Check Your Network Connectivity
Ensure that you have TCP 389 and TCP 445 connectivity with your preferred domain controller in the remote domain:
PS C:\> Test-NetConnection 192.168.68.240 -Port 389 ComputerName : 192.168.68.240 RemoteAddress : 192.168.68.240 RemotePort : 389 InterfaceAlias : vEthernet (Internet) SourceAddress : 192.168.68.110 TcpTestSucceeded : True
Perform the same test on port 445 against your domain controller.
Perform the same test on port 5985 against your Entra Connect Server.
Download and Install EasyEntra
Download and install EasyEntra. Select the default options when running the .msi installer.
Connect With AD Using In-App Authentication
If your PC is not domain-joined with the AD you’re connecting with, you must use in-app authentication:
Click Next and enter the FQDN of a domain controller or the domain FQDN (must be resolvable to IP address via Hosts file or DNS):
Select the domain controller you wish EasyEntra to communicate with. Pro tip: Select the DC that Entra Connect synchronizes with to eliminate intra-DC replication issues causing delays in Entra Connect delta synchronization.
Enable Remote Synchronization of Your Microsoft Entra Connect Server
The following steps are only necessary if you wish to enable the ability to trigger remote Entra Connect Server synchronization directly from EasyEntra. They are not needed for AD management.
The account you use to connect to Microsoft Entra Connect (configured in the previous step) basically needs two abilities to trigger a remote Entra Connect synchronization:
- Connect with remote PowerShell to the Entra Connect Server.
- Perform an Entra Connect synchronization.
Both of these requirements are described in more detail in section 2.4.4 in the Installation and Configuration Guide, but are also summarized briefly here for completeness.
For a non-domain-joined system, certain additional steps are required to enable this feature.
Enable Remote PowerShell Connectivity
On the Entra Connect Server, use the following command to start the Remote PowerShell Session permissions UI and assign Execute permissions to your account:
Set-PSSessionConfiguration -ShowSecurityDescriptorUI -Name Microsoft.PowerShell
Enable Entra Connect Server Synchronization Permissions
Assign the ability to trigger remote synchronization of Entra Connect by adding your account to the ADSyncOperators local group on the Entra Connect Server (if Entra Connect is installed on a DC, it will be a Domain Local group).
Enable Kerberos Authentication With the Entra Connect Server
When using a non-domain-joined PC, configuring the TrustedHosts list of your client PC is required. This will allow your system to do Kerberos authentication with the Entra Connect Server.
Note! You must temporarily enable the Windows Remote Management Service locally to configure the trusted hosts list.
Add the Entra Connect server to your TrustedHosts list by running the following PowerShell command on your client PC:
Set-Item WSMan:\localhost\Client\TrustedHosts -Value 'DC-01.easy365manager.local' -Concatenate -Force
Replace the server name with the FQDN of your Azure AD Connect Server.
Note! If WSMAN is not accessible (even though the WinRM service is started), you may need to enable PS Remoting:
Enable-PSRemoting
Verify that the Entra Connect Server was added successfully to your TrustedHosts list by issuing the following command:
PS C:\> Get-Item WSMAN:\localhost\client\TrustedHosts WSManConfig: Microsoft.WSMan.Management\WSMan::localhost\Client Type Name SourceOfValue Value ---- ---- ------------- ----- System.String TrustedHosts DC-01.easy365manager.local
You will now be able to manage your on-premises AD and perform one-click Entra Connect synchronization directly from EasyEntra.
If you started the Windows Remote Management Service on your client PC to complete the configuration, you can stop it again.
