Trend Micro

TM

Email Security
Directory Synchronization Tool
User's Guide
Stop advanced email threats and spam before they reach your network

Trend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:
http://docs.trendmicro.com/en-us/enterprise/trend-micro-emailsecurity.aspx
Trend Micro, the Trend Micro t-ball logo, OfficeScan, and Control Manager
are trademarks or registered trademarks of Trend Micro Incorporated. Allother product or company names may be trademarks or registeredtrademarks of their owners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: HSEM09718/230330
Release Date: December 11, 2023
Protected by U.S. Patent No.: Patents pending.

This documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Table of Contents
Preface
Preface ................................................................................ iv
Documentation .................................................................... iv
Audience .............................................................................. v
Document Conventions ......................................................... v

Chapter 1: Introduction
About Trend Micro Email Security ....................................... 1-2
About the Directory Synchronization Tool ............................ 1-2

Chapter 2: Installing the Directory Synchronization Tool
System Requirements ......................................................... 2-2
Downloading the Directory Synchronization Tool Installation
Program ............................................................................. 2-2
Installing the Directory Synchronization Tool ....................... 2-3
Updating the Directory Synchronization Tool ....................... 2-4

Chapter 3: Using the Directory Synchronization Tool
Configuring the Directory Synchronization Tool ................... 3-2
Configuring Service Settings .......................................... 3-2
Configuring the Source Directory .................................. 3-3
Creating an Microsoft Entra ID Application .............. 3-7
Removing the Source Directory ..................................... 3-9
Updating the Source Directory ....................................... 3-9
Testing Synchronization Locally ........................................ 3-10
Synchronizing Groups, Valid Recipients and Email Aliases .. 3-11
Viewing Synchronization History ....................................... 3-13
Configuring the Trend Micro Email Security Server ............ 3-13iDirectory Synchronization Tool User's Guide

Appendix A: Troubleshooting the Directory Synchronization Tool
Diagnostic Logs in the Directory Synchronization Tool ......... A-2
Troubleshooting the Directory Synchronization Tool ............ A-2

Appendix B: Advanced Settings
Customizing Search Filters ................................................. B-2
Specifying a Primary Email Alias ......................................... B-6

Index
Index ............................................................................... IN-1

ii

iii

Preface
Welcome to the Trend Micro Email Security Directory Synchronization Tool
User's Guide. This guide introduces the Directory Synchronization Tool andexplains how to use the Directory Synchronization Tool to synchronize
groups, valid recipients and email aliases from Microsoft Active Directory,
Open LDAP, IBM Domino and Microsoft Entra ID to the Trend Micro Email
Security server.
This section includes the following topics:• Documentation on page iv• Audience on page v• Document Conventions on page v

Documentation
The documentation set for Trend Micro Email Security includes thefollowing:
Table 1. Product Documentation
Document

Description

Online Help

The Online Help contains information about Trend Micro Email
Security and provides instructions on how to configure Trend
Micro Email Security to protect your network from spam,phishing, ransomware, graymail, Web threats, and malware
before they reach your network.

Directory Synchronization
Tool User's Guide

The Directory Synchronization Tool User's Guide is a PDF
document that introduces the Trend Micro Email Security
Directory Synchronization Tool and explains how to use the
Directory Synchronization Tool to synchronize groups, valid
recipients and email aliases from Microsoft Active Directory,
Open LDAP, IBM Domino and Microsoft Entra ID to the Trend
Micro Email Security server.

iv

Document
Support Portal

Description
The Support Portal is an online database of problem-solving
and troubleshooting information. It provides the latest
information about known product issues. To access the
Support Portal, go to the following website:
https://success.trendmicro.com

View and download the documentation at:
http://docs.trendmicro.com/en-us/enterprise/trend-micro-emailsecurity.aspx

Audience
The Trend Micro Email Security documentation is written for IT
administrators and security analysts. The documentation assumes that thereader has an in-depth knowledge of networking and information security,
including the following topics:• Network topologies• Directory management• Policy management and enforcement
The documentation does not assume the reader has any knowledge of threat
event correlation.

Document Conventions
The documentation uses the following conventions:
Table 2. Document Conventions
Convention

Description

UPPER CASE

Acronyms, abbreviations, and names of certain commands
and keys on the keyboard

Bold

Menus and menu commands, command buttons, tabs, andoptionsv

Directory Synchronization Tool User's Guide

Convention

Description

Italics

References to other documents

Monospace

Sample command lines, program code, web URLs, file names,and program output

Navigation > Path

The navigation path to reach a particular screen
For example, File > Save means, click File and then click
Save on the interface

Note

Tip

Important

WARNING!

vi

Configuration notes

Recommendations or suggestions

Information regarding required or default configuration
settings and product limitations

Critical actions and configuration options

Chapter 1

Introduction
This chapter provides a brief introduction about Trend Micro Email Security
and the Trend Micro Email Security Directory Synchronization Tool.
This chapter includes the following topics:• About Trend Micro Email Security on page 1-2• About the Directory Synchronization Tool on page 1-2

1-1

Directory Synchronization Tool User's Guide

About Trend Micro Email Security
Trend Micro Email Security is an enterprise-class solution that delivers
continuously updated protection to stop phishing, ransomware, Business
Email Compromise (BEC) scams, spam and other advanced email threats
before they reach your network. It provides advanced protection forMicrosoft Exchange Server, Microsoft Office 365, Google Gmail, and othercloud or on-premises email solutions.
Using Trend Micro Email Security, mail administrators set up policies tohandle email messages based on the threats detected. For example,
administrators can remove detected malware from incoming messages
before they reach the corporate network or quarantine detected spam andother inappropriate messages.

About the Directory Synchronization Tool
The Trend Micro Email Security Directory Synchronization Tool is adirectory connector supporting Microsoft Active Directory, Open LDAP, IBM
Domino and Microsoft Entra ID. Installed in your environment with access toyour Trend Micro Email Security, the tool can synchronize the users' valid
recipients, email aliases, and group members' valid recipients from thedirectory server to the Trend Micro Email Security server.
Synchronizing valid recipients enables the Trend Micro Email Security
server to verify each email message by performing a valid recipient check.
Synchronizing user groups enables you to define policies for user groups in
Trend Micro Email Security. Synchronizing email aliases enables Trend
Micro Email Security to identify and correlate different email addresses thatbelong to the same user, which facilitates the management of quarantined
email messages, approved and blocked senders and integration of digest
email messages for multiple end user email addresses.

1-2Chapter 2

Installing the Directory Synchronization
Tool
This chapter includes the following topics:• System Requirements on page 2-2• Downloading the Directory Synchronization Tool Installation Program on
page 2-2• Installing the Directory Synchronization Tool on page 2-3• Updating the Directory Synchronization Tool on page 2-4

2-1

Directory Synchronization Tool User's Guide

System Requirements
Review the system requirements before installing the Directory
Synchronization Tool.
Table 2-1. System Requirements for the Directory Synchronization Tool
Description

Specification
Operating system

Microsoft Windows Server 2016, 2019, or 2022

MemoryMinimum 2 GB

Hard disk

Minimum 1 GB available for installation and processing data

Microsoft .NET Framework• Recommended: 4.7 or above• Minimum: 4.0
Note
To support Transport Layer Security (TLS) 1.2,
install .NET Framework 4.6 or above. To support TLS
1.3, install .NET Framework 4.7 or above.

Internet accessInternet access required

Downloading the Directory Synchronization Tool
Installation Program
Procedure1.

Log on to the Trend Micro Email Security administrator console bynavigating to the following URL:
• North America, Latin America and Asia Pacifichttps://ui.tmes.trendmicro.com• Europe and Africa
https://ui.tmes.trendmicro.eu/

2-2Installing the Directory Synchronization Tool

• Australia and New Zealandhttps://ui.tmes-anz.trendmicro.com/• Japanhttps://ui.tmems-jp.trendmicro.com• Singapore
https://ui.tmes-sg.trendmicro.com• India
https://ui.tmes-in.trendmicro.com• Middle East (UAE)
https://ui.tmes-uae.trendmicro.com
2.

Go to Administration > Directory Management.

3.

Under the Downloads section, click
Synchronization Tool.

to download the Directory

Installing the Directory Synchronization Tool
Note
Before installing the Directory Synchronization Tool, make sure that thecomputer where you want to install the tool meets the system requirements
mentioned under the section System Requirements on page 2-2.
Note
Trend Micro recommends installing this tool on a separate computer thanwhere the source directory is installed.

2-3

Directory Synchronization Tool User's Guide

Procedure1.

Run the TMESDirectorySynchronizationTool.msi application package
to start the installation program.
The welcome screen appears.

2.

Click Next.
The Destination Folder screen displays.

3.

Select the location where you want to install the tool, and then click
Next.
The Ready to Install screen displays.

4.

Click Install.
The Installing screen displays.
Note
If the User Account Control is enabled on your operating system, a popup appears requiring you to provide the administrator's access. Click Yes
on the User Account Control pop-up to allow the installation.
If there are legacy configuration files in the destination folder, those files
will not be overwritten but will be directly used by the Directory
Synchronization Tool after installation.

5.

Click Finish on the screen that appears after the installation completes.

Updating the Directory Synchronization Tool
If your Directory Synchronization Tool is outdated or a new version isavailable in Trend Micro Email Security, you can update the Synchronization
Tool by uninstalling the current program and then installing the latest
version.

2-4

Installing the Directory Synchronization Tool

Procedure
1.

Download the latest version of the Directory Synchronization Tool fromthe Trend Micro Email Security server. See Downloading the Directory
Synchronization Tool Installation Program on page 2-2 for the procedure.

2.

Uninstall the current version of the Directory Synchronization Tool fromyour computer.
Note
Be aware that the existing configuration files will be backed up during
uninstallation. When you install a new version of the Directory
Synchronization Tool, your previous configurations will be restored.

3.

Install the latest version of the Directory Synchronization Tool you
downloaded in Step 1 of this procedure, into the same folder where you
installed the previous version. See Installing the Directory Synchronization
Tool on page 2-3 for the procedure.

4.

Start the Directory Synchronization Tool to review your settings.

2-5Chapter 3

Using the Directory Synchronization
Tool
This chapter includes the following topics:• Configuring the Directory Synchronization Tool on page 3-2• Testing Synchronization Locally on page 3-10
• Synchronizing Groups, Valid Recipients and Email Aliases on page 3-11
• Viewing Synchronization History on page 3-13
• Configuring the Trend Micro Email Security Server on page 3-13

3-1

Directory Synchronization Tool User's Guide

Configuring the Directory Synchronization Tool
Configuring Service Settings
You can configure your Trend Micro Email Security connection settings on
the Service Settings tab.

Procedure
1.

Start the Directory Synchronization Tool application.

2.

On the Service Settings tab, configure the following:• Under the Trend Micro Email Security Administrator Logon
Account section:• Account Name: Your administrator account name you use tolog on to Trend Micro Email Security administrator console.
• Service Auth Key: Your service authentication key for theTrend Micro Email Security server.
Note
You can find your service authentication key on the API Accesstab of the Service Integration screen (Administration >Service Integration) on Trend Micro Email Security
administrator console.

• Under the Proxy Settings section:• Do not use a proxy: If your network does not require a proxy,select this option to disable this setting.
• Automatically detect proxy settings: Select this option to let
the Directory Synchronization Tool automatically detect yournetwork proxy settings.

3-2

Using the Directory Synchronization Tool

• Manually set the proxy (HTTP): Select this option to manually
set the proxy Server and Port settings for your proxy server. If
required, type the proxy User Name and Password.
Note
The Directory Synchronization Tool currently supports only
the HTTP proxy.

• Synchronize every x hours: Select this option and specify the
duration in hours, if you want the Directory Synchronization Tool toautomatically synchronize user groups, valid recipients and email
aliases from the source directory to Trend Micro Email Security on
a recurrent basis.
Note
This setting requires you to synchronize data manually for the firsttime. Later on, the Directory Synchronization Tool automaticallysynchronizes data according to your setting.

3.

Click Apply.

Configuring the Source Directory
Configure your synchronization source directory settings on the Source
Directory tab.
Note
If your network includes multiple directory sources, configure all of thesesources on the Source Directory tab, to enable the Directory Synchronization
Tool to synchronize directory data from all of the sources.

Procedure
1.

Start the Directory Synchronization Tool application.
3-3

Directory Synchronization Tool User's Guide

2.

On the Source Directory tab, complete synchronization source settings.
a.

Next to Source Name, specify a source directory name.

b.

From the Source Type drop-down list, select one of the following as
the source directory type:• Open LDAP
• Microsoft Active Directory• Microsoft AD Global Catalog• Microsoft Office 365/Microsoft Entra ID• IBM Domino

3.

Complete required settings based on the source type you selected.
• If you select Microsoft Active Directory, Microsoft AD Global
Catalog, Open LDAP or IBM Domino, configure the following:
Host Name: The host name or IP address of the directory server.
Port: The port number used by directory server.
Use SSL: If your directory requires an encrypted connection, selectthis option.
• (Microsoft Active Directory or Microsoft AD Global Catalog)
User Name and Password: The user name and password that
Directory Synchronization Tool uses to access the source
directory.
• (Open LDAP or IBM Domino) LDAP Admin and Password: The
administrator account name and password that Directory
Synchronization Tool uses to access the LDAP server.
Base DN: The base distinguished name of the directory server.
Note
Skip this field if your source type is Microsoft AD Global Catalog or
IBM Domino.

3-4

Using the Directory Synchronization Tool

• If you select Microsoft Office 365/Microsoft Entra ID, configure thefollowing:
Tenant Domain: The domain name of the Microsoft Entra ID
directory, which is the sub-domain of the root domain"onmicrosoft.com".
Application ID: A unique ID required for a custom application to
make calls.
Application Key: A unique key value required for a custom
application to make calls.
For details about the Microsoft Entra ID settings, see Creating an
Microsoft Entra ID Application on page 3-7.
4.

Click Add to add the source to List of Source Directories to Sync at thebottom of the screen.

5.

Click the text Click here to manage groups under Sync Groups column,
or the group count under Group Count column to manage groups thatyou want to synchronize to the Trend Micro Email Security server.

3-5

Directory Synchronization Tool User's Guide

Figure 3-1. Source Directory tab

The Manage Groups to Sync window appears.
6.

From the Available Groups in Directory list on the left side of thescreen, select the groups that you want to synchronize, and then clickthe >> button to move the selected groups to the Groups to Sync list on
the right. You can use the search box at the top of the list to find groups
from the list.
To remove groups, that you do not want to synchronize, from the Groups
to Sync list, select the groups that you want to remove and then click <<button to move the selected groups to the Available Groups in Directory

3-6

Using the Directory Synchronization Tool

list. You can use the search box at the top of the list to find groups fromthe list.
Note
You can only select up to 50 groups from all the sources to synchronize.

7.

Click Apply.

Creating an Microsoft Entra ID Application
Trend Micro Email Security accesses and synchronizes Microsoft Entra ID
data using an application ID and a client secret. Create and register yourapplication on the Microsoft Entra ID admin center to obtain the application
ID and client secret.
Procedure
1.

Register an application.
a.

Log on to your Microsoft Entra ID admin center (https://
entra.microsoft.com/) as an admin user.

b.

Go to Microsoft Entra ID > App registrations, and click New
registration.

c.
d.

Type a name for your application, for example, TMES Microsoft

Entra ID Sync.

Under Redirect URI (optional), type the following URL of the Trend
Micro Email Security administrator console:• North America, Latin America and Asia Pacifichttps://ui.tmes.trendmicro.com• Europe and Africa
https://ui.tmes.trendmicro.eu/• Australia and New Zealandhttps://ui.tmes-anz.trendmicro.com/
3-7

Directory Synchronization Tool User's Guide• Japanhttps://ui.tmems-jp.trendmicro.com• Singapore
https://ui.tmes-sg.trendmicro.com• India
https://ui.tmes-in.trendmicro.com• Middle East (UAE)
https://ui.tmes-uae.trendmicro.coma.

Click Register.
A new application appears on the screen.

b.
2.

Copy and save the application ID for future use.

Add a client secret for your application.
a.

Access the application you created in Step 1.

b.

In the left navigation, click Certificates & secrets, and click New
client secret under Client secrets.

c.

Type a description for the client secret, select a 2-year option fromthe Expires drop-down list, and click Add.
A client secret generates in the Client secrets section. This value
will not be visible after you leave this screen.
Note
Directory synchronization will fail if the client secret expires. If thisoccurs, generate a new client secret.

d.
3.

Obtain API permissions for your application.
a.

3-8

Copy and save the client secret value for future use.
Access the application you created in Step 1.

Using the Directory Synchronization Toolb.

In the left navigation, click API permissions and click Add apermission.

c.

Click Microsoft Graph on the Microsoft APIs tab page.

d.

From application permissions, select the Directory.Read.All
permission under Directory, and click Add permissions.

e.

Click Grant admin consent for Your tenant name.

f.

Click Yes in the dialog box that appears.

Removing the Source Directory
You can remove the source directory in the Directory Synchronization Tool
from the Source Directory tab.
ImportantRemoving a directory source will also remove the policies applied to thegroups from this source while synchronizing directories the next time.

Procedure
1.

Start the Directory Synchronization Tool application.

2.

Click the Source Directory tab.

3.

Under the List of Source Directories to Sync section at the bottom of thescreen, click the directory source you want to remove from the list, andthen click Remove at the bottom right of the screen.

Updating the Source Directory
If you have already configured a source directory in the Directory
Synchronization Tool, you can update its information to match the current
settings.

3-9

Directory Synchronization Tool User's Guide

Procedure
1.

Start the Directory Synchronization Tool application.

2.

Click the Source Directory tab.

3.

Under the List of Source Directories to Sync section at the bottom of thescreen, double-click the directory source that you want to update.
All the fields under the Synchronization Source Setting section
populate with the current source information.

4.

Modify the information as required, and then click Update to update
and save the source information.

What to do next
There are some advanced settings in the Directory Synchronization Tool. For
details, see the following topics in Advanced Settings on page B-1:
• Customizing Search Filters on page B-2• Specifying a Primary Email Alias on page B-6

Testing Synchronization Locally
The Directory Synchronization Tool enables you to test the synchronizationon the local computer before synchronizing with the Trend Micro Email
Security server.
Procedure

3-10

1.

Start the Directory Synchronization Tool application.

2.

Click the Source Directory tab.

3.

Configure at least one source directory for the Directory
Synchronization Tool to synchronize from. See Configuring the Source
Directory on page 3-3 for the procedure.

4.

Click Test Sync Locally, and select a folder on your local computer
where you want to save the directory data.

Using the Directory Synchronization Tool

5.

The synchronization starts and creates the text (txt) files that containgroups, valid recipients and/or email aliases, at your selected location.

6.

The synchronization starts and creates one or all of the following text(txt) files after it completes:• Valid_recipients_yyyymmdd-hhmmss.txt: This file includes theemail addresses that are included in the source directory, andbelong to the email domains that are registered with Trend Micro
Email Security.
• Groups_yyyymmdd-hhmmss.txt: This file provides the association ofeach email address with the groups in the source directory, andincludes the following information:• The number of email addresses that are included in eachgroup.
• The group names that include a certain email address.
• email_aliases_yyyymmdd-hhmmss.txt: This file includes email
addresses and their relationship with email aliases.
Note
The Directory Synchronization Tool will only create these files if therelated synchronization type is selected, and the directory sources
contain the related data.

Synchronizing Groups, Valid Recipients and Email
Aliases
The Directory Synchronization Tool synchronizes groups, valid recipientsand email aliases from the source directory to the Trend Micro Email
Security server.
Trend Micro recommends testing the synchronization locally before
synchronizing the groups, valid recipients and email aliases from the source

3-11

Directory Synchronization Tool User's Guide

directory to the Trend Micro Email Security server. See Testing
Synchronization Locally on page 3-10 for the procedure.
Important• To synchronize groups, valid recipients and email aliases successfully,
make sure the domains of these targets have been registered with andverified on Trend Micro Email Security. You can find your domain statuson the Domains screen on the Trend Micro Email Security administrator
console.
• You can only use one Directory Synchronization Tool application tosynchronize data. If you use the Directory Synchronization Tool
application installed on another location, the data synchronized from thelast tool will be overwritten.

Procedure
1.

Start the Directory Synchronization Tool application.

2.

Configure the Trend Micro Email Security service settings. See
Configuring Service Settings on page 3-2 for the procedure.

3.

Configure at least one source directory for the Directory
Synchronization Tool to synchronize from. See Configuring the Source
Directory on page 3-3 for the procedure.

4.

On the Service Settings tab, click Synchronize Now.
The synchronization starts, and the status displays on the
Synchronization History tab.
Trend Micro Email Security collects the following types of data during
the synchronization:• Display names• Email addresses• Group email addresses

3-12Using the Directory Synchronization Tool

• Group and member relationships• Email aliases

Viewing Synchronization History
The Directory Synchronization Tool keeps the synchronization history anddisplays the last seven (7) days of history on the Synchronization History
tab.
Procedure
1.

Start the Directory Synchronization Tool application.

2.

Click the Synchronization History tab to view the history.
The logs include the following statuses:• Synchronization started• Synchronizing data…
• Synchronization successful• Synchronization failed

Configuring the Trend Micro Email Security Server
After synchronizing groups, valid recipients and email aliases from thesource directory to the Trend Micro Email Security server, perform thefollowing:• Configure policies on the Trend Micro Email Security server for the
newly imported groups.
See “Configuring Policies” in the Trend Micro Email Security Online
Help for details.
• Enable Trend Micro Email Security to perform the valid recipient checkon the Directory Management screen (Administration > DirectoryManagement).
3-13

Directory Synchronization Tool User's Guide

See “About Directory Management” in the Trend Micro Email Security
Online Help for details.
• Configure the primary email alias to receive digest email messages. As aresult, digest email messages will not be delivered to other associatedemail aliases.

3-14

Appendix A

Troubleshooting the Directory
Synchronization Tool
This appendix includes the following topics:• Diagnostic Logs in the Directory Synchronization Tool on page A-2• Troubleshooting the Directory Synchronization Tool on page A-2

A-1

Directory Synchronization Tool User's Guide

Diagnostic Logs in the Directory SynchronizationTool
In case you encounter any problem in using the Trend Micro Email Security
Directory Synchronization Tool, you can collect diagnostic logs and send
them to for analysis to provide any solution.
The diagnostic log files are located at the following directory:…\Trend Micro\Trend Micro Email Security Directory Sync Client\logs\The Directory Synchronization Tool creates the following three types of logs:• dsaconfig.log: Contains the UI configuration log details.
• dsaservice.log: Contains synchronization tool service log details.
• dsamonitor.log: Contains monitor log details.

Troubleshooting the Directory Synchronization
Tool
If the Trend Micro Email Security Directory Synchronization Tool is unable
to synchronize groups, valid recipients and email aliases from the source
directory to the Trend Micro Email Security server, go through the following
steps to troubleshoot the problem:
Procedure
1.

Navigate to the Synchronization History tab to view the reason
mentioned in the Details column for the latest unsuccessful attempt.

2.

Check the connection with the Trend Micro Email Security server:• Go to the Service Settings tab, and click Apply.
The Directory Synchronization Tool attempts to connect to the
Trend Micro Email Security server, and verifies your account nameand service authentication key. This step also verifies if directorysynchronization is enabled on the Trend Micro Email Security

A-2

Troubleshooting the Directory Synchronization Tool

server to allow the Directory Synchronization Tool to synchronize
data to the Trend Micro Email Security server.
3.

If the Directory Synchronization Tool is outdated, or the new version of
the tool is available on the Trend Micro Email Security server, download
and install the latest version.

4.

If the Directory Synchronization Tool uploads the synchronization result
to the Trend Micro Email Security server, but the Trend Micro Email
Security server still does not update the directory data, then wait forsome time, and try again.

5.

If the problem persists, contact Trend Micro Technical Support for help.
Before contacting Trend Micro Technical Support, make sure that you
have the diagnostic logs that you can send to the Technical Support
representative, if required. See Diagnostic Logs in the Directory
Synchronization Tool on page A-2 for the details on diagnostic logs.

A-3

Appendix B

Advanced Settings
This appendix includes the following topics:• Customizing Search Filters on page B-2• Specifying a Primary Email Alias on page B-6

B-1

Directory Synchronization Tool User's Guide

Customizing Search Filters
Procedure
1.

Go to the directory where the Directory Synchronization Tool isinstalled.

2.

Open the clientconf.xml configuration file.

3.

Customize search filters based on your requirements.
For Microsoft Entra ID, use the $filter parameter provided byMicrosoft Graph to define search filters. For other source types, use
LDAP syntax filters to define LDAP search filters.
Note
For valid recipient filters, it is recommended that you disable Recipient
Filter on the administrator console and verify customized filters to avoid
unexpected email loss for valid recipients. After verification, enable
Recipient Filter for the customized filters to take effect.
To disable or enable Recipient Filter, go to Inbound Protection >Connection Filtering > Recipient Filter on the administrator console.
Source Type
Microsoft Active Directory and Microsoft
AD Global Catalog

Procedure
Within the <default> section, add
customized filters as follows:• To create a filter for valid recipients,
specify a value for<customizedFilter> in the<validRecipient> tag.
• To create a filter for group members,
specify a value for<customizedFilter> in the<members> tag.

B-2

Advanced Settings

Source Type

Procedure• To create a filter for email aliases,
specify a value for<customizedFilter> in the<emailAliases> tag.

Open LDAP

Within the <openLDAP> section, add
customized filters as follows:• To create a filter for valid recipients,
specify a value for<customizedFilter> in the<validRecipient> tag.
• To create a filter for group members,
specify a value for<customizedFilter> in the<members> tag.
• To create a filter for email aliases,
specify a value for<customizedFilter> in the<emailAliases> tag.

IBM Domino

Within the <dominoLDAP> section, add
customized filters as follows:• To create a filter for valid recipients,
specify a value for<customizedFilter> in the<validRecipient> tag.
• To create a filter for group members,
specify a value for<customizedFilter> in the<members> tag.
• To create a filter for email aliases,
specify a value for<customizedFilter> in the<emailAliases> tag.

Microsoft Office 365/Microsoft Entra ID

Within the <AAD> section, add customized
filters as follows:

B-3

Directory Synchronization Tool User's Guide

Source Type

Procedure• To create a filter for valid recipients,
specify a value for<rcptCustomizedFilter>.
• To create a filter for email aliases,
specify a value for<aliasCustomizedFilter>.

Note
Note that some special characters need to be replaced with escapecharacters in your syntax.
• Use "&amp;" instead of "&".
• Use "&lt;" instead of "<".
• Use "&gt;" instead of ">".

If you are using Microsoft Active Directory or Microsoft AD Global
Catalog:• To filter out disabled users from valid recipients, use the following
syntax:<validRecipient><objectClass>*</objectClass><customizedFilter>!(useraccountcontrol=514)</customizedFilter><emailAttr>mail</emailAttr><emailAttr>proxyAddresses</emailAttr></validRecipient>• To filter out disabled users that belong to a specific domain fromvalid recipients, use the following syntax:<validRecipient><objectClass>*</objectClass><customizedFilter>&amp;(!(useraccountcontrol=514))(proxyAddresses=*@example.com)</customizedFilter><emailAttr>mail</emailAttr><emailAttr>proxyAddresses</emailAttr></validRecipient>

If you are using Microsoft Entra ID:

B-4

Advanced Settings• To filter out disabled users from valid recipients, use the following
syntax:<AAD><rcptObjectClass>users,groups</rcptObjectClass><rcptCustomizedFilter>accountEnabled eq true</rcptCustomizedFilter><emailAttr>mail,proxyAddresses</emailAttr><primaryEmailAttr>mail</primaryEmailAttr><aliasObjectClass>users,groups</aliasObjectClass><aliasCustomizedFilter></aliasCustomizedFilter><aliasIdentifier>id</aliasIdentifier><groupsDisplayNameAttr>displayName</groupsDisplayNameAttr><membersObjectClass>users,groups</membersObjectClass><membersDisplayNameAttr>displayName</membersDisplayNameAttr><membersFirstNameAttr>givenName</membersFirstNameAttr><membersMiddleNameAttr></membersMiddleNameAttr><membersLastNameAttr>surname</membersLastNameAttr><membersTitleAttr>jobTitle</membersTitleAttr></AAD>• To filter out disabled users whose email addresses start with "test"from valid recipients, use the following syntax:<AAD><rcptObjectClass>users,groups</rcptObjectClass><rcptCustomizedFilter>accountEnabled eq true and startswith(mail, 'test')</rcptCustomizedFilter><emailAttr>mail,proxyAddresses</emailAttr><primaryEmailAttr>mail</primaryEmailAttr><aliasObjectClass>users,groups</aliasObjectClass><aliasCustomizedFilter></aliasCustomizedFilter><aliasIdentifier>id</aliasIdentifier><groupsDisplayNameAttr>displayName</groupsDisplayNameAttr><membersObjectClass>users,groups</membersObjectClass><membersDisplayNameAttr>displayName</membersDisplayNameAttr><membersFirstNameAttr>givenName</membersFirstNameAttr><membersMiddleNameAttr></membersMiddleNameAttr><membersLastNameAttr>surname</membersLastNameAttr><membersTitleAttr>jobTitle</membersTitleAttr></AAD>• To filter out users whose email addresses start with "test_user" andgroups whose email addresses start with "test_group" from valid
recipients, use the following syntax:
Note
If you create one recipient filter with <rcptCustomizedFilter>, thisfilter is applicable only to the first object specified in the<rcptObjectClass> tag. You can create multiple recipient filters
following the object order in the <rcptObjectClass> tag.
The situation is the same with <aliasCustomizedFilter>.

B-5

Directory Synchronization Tool User's Guide<AAD><rcptObjectClass>users,groups</rcptObjectClass><rcptCustomizedFilter>startswith(mail, 'test_user')</rcptCustomizedFilter><rcptCustomizedFilter>startswith(mail, 'test_group')</rcptCustomizedFilter><emailAttr>mail,proxyAddresses</emailAttr><primaryEmailAttr>mail</primaryEmailAttr><aliasObjectClass>users,groups</aliasObjectClass><aliasCustomizedFilter></aliasCustomizedFilter><aliasIdentifier>id</aliasIdentifier><groupsDisplayNameAttr>displayName</groupsDisplayNameAttr><membersObjectClass>users,groups</membersObjectClass><membersDisplayNameAttr>displayName</membersDisplayNameAttr><membersFirstNameAttr>givenName</membersFirstNameAttr><membersMiddleNameAttr></membersMiddleNameAttr><membersLastNameAttr>surname</membersLastNameAttr><membersTitleAttr>jobTitle</membersTitleAttr></AAD>

4.

Save your changes and exit.

Specifying a Primary Email Alias
Procedure
1.

Go to the directory where the Directory Synchronization Tool isinstalled.

2.

Open the clientconf.xml configuration file.

3.

Set the <enableSetPrimaryEmail> tag to true to enable the primaryemail alias setting.

4.

Edit the value of <primaryEmailAttr> in the <emailAliases> tag.
By default, the <primaryEmailAttr> tag is set to mail for each source
type, which means the mail attribute will be retrieved from thedirectory server and used as the primary email alias. You can change theattribute if necessary.

5.

B-6

Save the changes and exit.

IndexSymbols

T.NET Framework, 2-2technical support, A-3
testing synchronization, 3-10, 3-11
troubleshoot, A-2

A
about
Directory Synchronization Tool,
1-2

Trend Micro Email Security, 1-2authentication key, 3-2
automatic synchronization, 3-3
DU
user groups, 1-2, 3-5, 3-11
V
valid recipient check, 1-2, 3-11
valid recipients, 1-2, 3-5, 3-11

diagnostic logs, A-2
E
email aliases, 1-2, 3-11
I
installation package, 2-4
L
log files, A-2
logs, 3-13, A-2
S
service authentication key, 3-2
settings
proxy, 3-2
server, 3-13
service, 3-2
source directory, 3-3
setup file, 2-4system requirements, 2-2, 2-3
IN-1

Item Code: HSEM09718/230330