Active Directory

This section configures the synchronization of the app with Active Directory.

AD Connection Parameters

Parameter	Description
FQDN or IP address of the domain controller, the connection port, and the Active Directory domain	More details admin guides. If the Active Directory forest contains multiple domains, leave the domain field blank. Otherwise, users will need to manually clear this field when logging into the app.
Max login attempts Failed login timeout (in seconds)	Protection against password brute-forcing. Set the number of attempts to 1 less than in AD policies.
Prefill the domain part of the login on clients	Choose whether to pre-fill the domain on clients so that users with different SamAccountName and UserPrincipalName do not experience login issues.

Logout Settings for AD

Parameter	Description
User logout request (Leave server button in web and desktop, Leave the server on Android and iOS), Logout request on user account deletion (more details), Administrator logout request (Logout button for the user in the admin panel)	These logout request sources are system sources: they cannot be turned off, but you can configure the auto-confirmation time for them.
Enable auto-confirmation of user logout requests	Whether requests that users send from the profile settings in the app are confirmed automatically.
Logout request on user account disable in AD	Automatic logout from sessions when an account is disabled in AD and sending a logout request.
Logout request on user block in AD	Automatic logout from sessions when an account is locked in AD and sending a logout request.
Logout request on user account expiration in AD	Automatic logout from sessions when an account expires in AD and sending a logout request.
Logout request on password expiration in AD	Automatic logout from sessions when a password expires in AD and sending a logout request.
Logout request on exclusion from AD sync selection	Automatic logout from sessions and sending a logout request when a user is excluded from the AD synchronization filter with the application.
Logout request on password change in AD	Automatic logout from sessions after a password is changed in AD and sending a logout request.
User Account Disabled (AD LDS)	Automatic exit from sessions and sending a logout request if the account's attribute msDS-UserAccountDisabled in AD LDS is equal to TRUE.
Auto-confirm after N days	Each reason has its own Auto-confirm after checkbox and a number of days from 0 to 30. After this time, the logout request will be confirmed without administrator involvement. Since version 3.58. For immediate confirmation, select 0 days.

Authorization Method

Choose how the server verifies the user's login and password in AD: SIMPLE — using simple LDAP authentication (simple bind), NTLM — using the NTLM protocol.

Channel Binding Token (CBT) Policy Support

If the Domain Controller: LDAP server channel binding token requirements policy is set to Always or When supported, select the Enable NTLM channel binding (CBT) checkbox here. Without it, users will get the “Invalid credentials” error when signing in to eXpress. The checkbox is available starting with version 3.60.

Attribute Mapping

Define which user attributes from AD will be used in the messenger profiles.

Write attributes in the same case as in LDAP records.

Manage Settings

Button	Action
Default settings	Resets settings to default values.
Delete	Disables synchronization. Does not affect existing users.
Save	Applies changes.

Additional Questions

The Account from AD Did Not Appear in the User List. What to Do?

If an account from AD does not appear in the Users section of the admin panel:

1. Wait for synchronization or force it manually.
2. Check in AD: account status, password expiration, and other restrictions.
3. Test the synchronization filter with a test LDAP query, for example via ldapsearch.

What Are the Requirements for User Avatars in AD?

JPG format, 500×500 pixels, no larger than 100 KB.