Change a Password Sync configuration from the command line  |  User management  |  Google Workspace Help
Skip to main content
User management
Documentation
Administrators
Getting started
Apps and integrations
Set up and manage services
Billing and subscriptions
Data migration
Data synchronization
Device management
Domain management
Reports and monitoring
Security and data protection
User management
Legal and compliance
Support and troubleshooting
Users
Calendar
Chat
Cloud Search
Gmail
Groups
Docs, Forms, Sheets, and Slides
Drive
Keep
Meet
Meet Hardware
Sites
Vids
Developers
Apps Script
Marketplace
Workspace APIs
Training & business user guides
Workspace Learning Center
Google Skills
Community
Communities
Workspace Admin Community
Workspace Developers Community
Support
/
English
Deutsch
Español – América Latina
Français
Indonesia
Italiano
Nederlands
Polski
Português – Brasil
Svenska
Tiếng Việt
Türkçe
Русский
עברית
العربيّة
فارسی
हिंदी
বাংলা
ภาษาไทย
中文 – 简体
中文 – 繁體
日本語
한국어
Sign in
Administrators
User management
Admin console
Contact us
Overview
Guides
User management
Overview
Guides
Documentation
More
Community
More
Support
Add & manage users
Options for adding users
Add an account for a new user
Add or update multiple users from a CSV file
Use a third-party tool for quick mass provisioning
Name guidelines for users and groups
Avoid sharing an account among users
Request additional Education licenses
Delete or remove a user from your organization
Suspend a user temporarily
Restore a suspended user
Restore a recently deleted user
Archive former employee accounts
Archive a single-user subscription
Maintain data security after an employee leaves
Choose a language for new users
Change the default time zone for new users
Impact on Google apps when changing a user's email address
Let users buy add-ons
Manage individual Google Cloud accounts
Investigate user problems with log events
Advanced user management
User profiles & Directory
Overview: Set up and manage the Directory
Turn Directory on or off
Control who users can find in the Directory
Customize a directory for a team or group
Hide a user from the Directory
Hide Groups or domain shared contacts
Add information to a user's Directory profile
Add or change a user's profile photo
Change a user's profile name
Allow Directory users to change their profile and photo
Create custom attributes for user profiles
Troubleshoot custom user attribute errors
Add advanced contact information
Add shared external contacts to the Directory
Bulk update user profiles with LDAP directory or API
Let third-party apps access Directory data
Email addresses & aliases
Overview: Add additional email addresses for users
Add or delete an alternate email address (email alias)
Delegate a user's email address
Set which email addresses show in the Directory
Overview: Changing a Directory user's name or email address
Administrator roles & privileges
About administrator roles
Prebuilt administrator roles
Administrator privilege definitions
Assign specific admin roles
Make a user an admin
Create, edit, and delete custom admin roles
Create an admin role for an organizational unit
Remove Google Workspace administrator privileges
Delete an administrator account
View role assignments and privileges
Security best practices for administrator accounts
Set admin privileges to protect user privacy
Designate users with analytics data access
Designate users with temporary class access
Passwords & account recovery
Enforce and monitor password requirements for users
Allow users to skip passwords at sign-in
Prevent phishing attacks on your users
Phishing prevention with Password Alert FAQ
Set up password recovery for users
Add recovery information for admins and users
Allow super administrators to recover their password
Allow users to add password recovery details
Recovering administrator access to your account
Account recovery information for Support
Reset a user's password
Restore a suspended Gmail account
Unmanaged users
Find and add unmanaged users
Prevent creation of unmanaged user accounts
Before using the transfer tool
Use the transfer tool to migrate unmanaged users
Use CSV to migrate unmanaged users
Sync users with an external directory
Sync data with your LDAP server
Compare options for syncing directories
Directory Sync
Get started with Directory Sync
System requirements
Supported network connections
Set up a VPC access connector
Enable the Data Connectors API
Add, edit, or remove an external directory
Set up user sync
Set up group sync
Run a sync
Replace the domain name for synced users
Update user or group settings
Check log events for Directory Sync
Troubleshoot Directory Sync
Directory Sync FAQ
Google Cloud Directory Sync (GCDS)
About Google Cloud Directory Sync
GCDS best practices
What is synced?
System requirements
1. Download and install GCDS
2. Prepare your LDAP directory
3. Organize LDAP data
4. Authorize your Google Account
5. Allow access to URLs and ports
What is Configuration Manager?
Set up your sync with Configuration Manager
Learn more about Configuration Manager options
Work with configuration files
Use LDAP search rules to synchronize data
Omit data with exclusion rules and queries
Use limits with GCDS
Maintain different user attributes during a sync
GCDS synchronization options
Perform a manual synchronization
Synchronize using the command line
Schedule automatic synchronizations
Manage and assign licenses
Archive or unarchive users
Sync groups and users to a Cloud Search identity source
Manage conflicting accounts with GCDS
Troubleshoot certificate-related problems
GCDS error messages
Troubleshoot common GCDS issues
GCDS FAQ
What GCDS information do I need before contacting support?
Update GCDS
GCDS reports and notifications
Google Cloud Directory Sync release notes
Inbound SCIM
Get started with Inbound SCIM
Manage connections
Troubleshoot Inbound SCIM
Sync user passwords with Microsoft Active Directory
About Password Sync
How does Password Sync work?
1. Get ready to use Password Sync
2. Choose your authentication method
3. Create a service account
4. Download and install
5. Configure Password Sync
6. Set up user authentication
7. Have users change their AD passwords
Install and configure Password Sync from the command line
Change a Password Sync configuration from the command line
How to exclude some users from Password Sync
Troubleshoot Password Sync
Use logs to troubleshoot
Authentication errors in Password Sync logs
Password Sync error codes and messages
Some user passwords aren't syncing
Upgrade Password Sync
Password Sync release notes
Administrators
Getting started
Apps and integrations
Set up and manage services
Billing and subscriptions
Data migration
Data synchronization
Device management
Domain management
Reports and monitoring
Security and data protection
User management
Legal and compliance
Support and troubleshooting
Users
Calendar
Chat
Cloud Search
Gmail
Groups
Docs, Forms, Sheets, and Slides
Drive
Keep
Meet
Meet Hardware
Sites
Vids
Developers
Apps Script
Marketplace
Workspace APIs
Training & business user guides
Workspace Learning Center
Google Skills
Communities
Workspace Admin Community
Workspace Developers Community
Google Workspace Help
Administrators
User management
Guides
Send feedback
Change a Password Sync configuration from the command line
Stay organized with collections
Save and categorize content based on your preferences.
Instead of using the configuration wizard, you can change the
Password Sync configuration from the command line.
When can I change a Password Sync configuration from the command line?
You can change a Password Sync configuration from the command line
when using:
Password Sync version 1.6 or later.
A service account for Google authentication. Learn more
The Password Sync application's security context to query
Microsoft Active Directory.
For other configuration options, go to Configure Password Sync.
Change a Password Sync configuration from the command line
Sign in to the domain controller as a domain administrator. The account must be from the domain controller's domain.
From a command prompt, navigate to the Password Sync program
folder. The default location is C:\Program Files\Google
Password Sync.
For example: cd C:\Program Files\Google\Password Sync
Review the settings table below.
From the command prompt on your domain controller, begin building the
command.
Start with the following command and append the arguments and parameters
that you want to update. Precede each argument with 2 dashes and all
lowercase letters. Enclose the parameters in quotation marks.
PasswordSync.exe
Note: The final version should be a single command without line breaks.
Argument
Parameter
--admin_email
The email address of your Google administrator.
Example: --admin_email="admin@solarmora.com"
--base_dn
(Optional) Your Active Directory domain's base distinguished name (DN).
When this parameter is omitted, Password Sync attempts to autodetect the base DN.
Example: --base_dn="OU=users,DC=mydomain,DC=com"
--credentials_file
The full path to your service account JSON file.
Note: The JSON file has a key that allows access to your Google domain. After authentication, remove the file from the system.
Example:
--credentials_file="c:\users\administrator\downloads\service_account.json"
--mail_attribute
(Optional) The Active Directory attribute that has each user's Google email address.
When this parameter is omitted, Password Sync uses the default "mail" attribute.
Example: --mail_attribute="mail"
--nouse_gui
Runs the utility from the command line, without a GUI.
No parameter required.
--norestart_service
(Optional)
When specified, Password Sync skips the service restart after saving the configuration.
No parameter required.
--nowait_at_exit
(Optional)
When specified, Password Sync closes the utility without waiting for the Enter key.
No parameter required.
Password Sync configuration example
In this example, the domain administrator's address is admin@solarmora.com.
The Active Directory base DN is OU=users,DC=mydomain,DC=com. The service
account's JSON file is located on the domain controller at
c:\users\administrator\downloads\service_account.json. Each username is
stored in Active Directory's mail attribute. Run this command without
using the GUI.
Note: This example command is a continual single line. Any line breaks
visible here are for page formatting only.
PasswordSync.exe --admin_email="admin@solarmora.com"
--base_dn="OU=users,DC=mydomain,DC=com"
--credentials_file="c:\users\administrator\downloads\service_account.json"
--mail_attribute="mail" --nouse_gui
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.
Send feedback
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-07-17 UTC.
Need to tell us more?
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-07-17 UTC."],[],[]]
Try Google Workspace
Boost your productivity with AI at no cost
Admin Community
Get answers from industry peers and experts
Customer Care
Learn about support options and services
Documentation & training
Help Centers
Developer guides
Learning Center
Google Skills
Tools
Admin console
Apps Script Dashboard
Google Cloud console
Support
Admin Community
Developers Community
Customer Care
Terms
Privacy
Manage cookies
English
Deutsch
Español – América Latina
Français
Indonesia
Italiano
Nederlands
Polski
Português – Brasil
Svenska
Tiếng Việt
Türkçe
Русский
עברית
العربيّة
فارسی
हिंदी
বাংলা
ภาษาไทย
中文 – 简体
中文 – 繁體
日本語
한국어