Active Directory synchronization with transformation?

Question

I'm not too familiar with Active Directory, so I may be taking the wrong approach here...

I'd like to have my master active directory instance replicated to another instance on a continuous basis, with various attributes changed. For example, I may want the passwords changed for all users, set to something random in the replica copy.

Data movement will only be one way - always from the master to the replica. The replica should be identical to the master with the exception of the modified attributes.

What's a good way to to do this?

I'd like to do this with multiple master ADs as well - the replica AD should contain the superset of users in all master ADs.

An alternative might be to layer something on top of my master ADs that perform the password/attribute changes on the fly. Is this possible/desirable?

Answer 1

Can you provide any more information on what is it that you are trying to accomplish? That might provide some more insight into how best to solve the problem. Are you talking about replicating information between domains within the same forest? Or are you talking about replicating across forests?

You might take a look at some of the MIIS documentation and see if that would work for what you have in mind.