How to Set Up Google Cloud Directory Sync (GCDS) with Active Directory

The Challenge of Dual Identity Management

If your organization uses Microsoft Active Directory (AD) to manage employee computer logins on-premise, but uses Google Workspace for email and cloud storage, you face a major administrative headache. Every time a new employee is hired, the IT department must create an account in Active Directory and a separate account in Google Workspace. When an employee is terminated, both accounts must be disabled manually. If IT forgets to disable the Google account, a terminated employee retains access to corporate emails.

To solve this, Google provides a free enterprise utility called Google Cloud Directory Sync (GCDS). This tool acts as a one-way synchronization bridge, reading your Active Directory database and automatically creating, updating, or suspending users in Google Workspace to perfectly match your on-premise environment.

Step 1: Download and Install GCDS

GCDS is a Java-based application that must be installed on a server within your corporate network (it does not need to be installed directly on a Domain Controller, but it must be able to ping the Domain Controller).

1. Download the latest version of GCDS from the official Google Workspace Admin portal.
2. Install the application on your chosen utility server.
3. Launch the Configuration Manager GUI.

Step 2: Authenticate with Google Workspace

First, you must authorize GCDS to make changes to your cloud environment.

1. In the Configuration Manager, go to the Google Domain Configuration tab.
2. Enter your primary Google Workspace domain name (e.g., yourcompany.com).
3. Click Authorize Now. This will open a web browser. Log in with your Super Administrator account and click Allow to generate an OAuth token.

Step 3: Connect to Active Directory (LDAP)

Next, you must point GCDS to your on-premise Active Directory database.

1. Go to the LDAP Configuration tab.
2. Select MS Active Directory from the Server Type dropdown.
3. Enter the hostname or IP address of your primary Domain Controller (e.g., 10.0.0.5).
4. Base DN: This is the root of your search. To sync the entire company, enter your domain’s distinguished name (e.g., DC=corp,DC=yourcompany,DC=com).
5. Authorized User: Enter the credentials of a service account with read access to AD (e.g., [email protected]).
6. Click Test Connection to verify it works.

Step 4: Define the User Search Rules

You must tell GCDS which Active Directory users should actually be created in Google Workspace (you don’t want it trying to create Google accounts for built-in AD system accounts or service accounts).

1. Go to the Users tab, then Search Rules.
2. Click Add Search Rule.
3. Create an LDAP filter that only targets standard human users. A common filter is: (&(objectCategory=person)(objectClass=user)(mail=*)). This ensures only users who actually have an email address populated in AD will be synced.

Step 5: Simulate the Sync

CRITICAL WARNING: Never run a live sync on your first attempt. If your LDAP search rules are configured incorrectly, GCDS might assume all your users have been deleted from AD, and it will proceed to instantly suspend every single user in Google Workspace, bringing your company to a halt.

1. Go to the Sync tab.
2. Click Simulate Sync.
3. GCDS will read your AD environment and generate a massive log report detailing exactly what would happen if you clicked the real sync button. Read this report carefully. Verify that it says “X users will be created” and not “1000 users will be suspended.”
4. Once you are satisfied with the simulation, you can click Sync & Apply Changes to perform the actual synchronization.