GWS2AD
Google Workspace → Active Directory

Keep Active Directory in step with Google Workspace.

GWS2AD is an admin portal that mirrors your Google users, groups and organizational units into Active Directory. Read the plan first. Keep what you choose. Change nothing by surprise.

View on GitHub See it in action
  • One-way syncGoogle is the master list. AD never changes Google.
  • Preview firstNothing changes until you confirm.
  • Demo mode includedTry it on sample data, no credentials.
  • Open sourceMIT licensed, with 11 test suites.
What it does

Everything a sync needs, nothing it doesn't.

Google Workspace stays the source of truth. GWS2AD makes Active Directory match it, and shows its work along the way.

  • Users, groups and OUs

    Creates and updates people and groups, keeps group membership identical to Google, and builds the OU tree. When someone moves OU in Google, they move in AD.

  • Preview before every sync

    A summary line, then every create, update, move and delete, with the deletes up top in red. The confirm button tells you how many deletions it will run.

  • Guard rails on deletes

    Click Keep in AD on anything that should stay, and say why. Leftover OUs are only removed when they're empty, deepest first.

  • Roles and permissions

    One Owner, Admins, and named roles such as "Help Desk" with exactly the permissions you pick. The server enforces them, not just the buttons.

  • Two-step sign-in

    Every account uses an authenticator app. Recovery codes, lockouts after repeated failures, and an audit trail of who did what.

  • Demo and Live modes

    Starts on a made-up company with pretend Google and AD. Switch to your real systems when you're ready, after the connection checks pass.

The sync preview

Read the plan before you press go.

Every sync opens a preview first. You see exactly what will be created, updated, moved and deleted. Nothing is touched until you confirm.

  • One line up top counts what the sync will do, so the risk is clear before you scroll.
  • Deletes come first, in red, each with a Keep in AD button.
  • Long lists fold away. Creates, updates and membership start closed unless they're short.
  • The confirm button shows the cost, such as "Confirm sync (4 deletions)".
Deletes first, and the confirm button shows what it will do.
Day-to-day admin

People and groups, in one place.

Add, edit and delete Google Workspace users and groups right from the dashboard. Pick an OU from a tree and tick the groups, all in one window.

Users: search, page through, edit or delete.
Groups, with member counts at a glance.
Add a user. Pick the OU from a tree.
Add a group in three fields.
Access control

Give people only what they need.

Built-in Owner and Admin roles, plus roles you define yourself. Each account sees only what its role allows.

Roles: a named set of permissions, such as "Help Desk".
Accounts: who can sign in, and as what.
Built-in guidance

Explained where you need it.

A How It Works page walks through a sync in plain words, and small tooltips cover the details, like what the email switch does.

  • A four-step guide to a normal day.
  • A checklist of exactly what a sync changes.
  • Safety notes: backups, the ignore list, and your role.
Your account

Clear about who you are and what you can do.

Your profile lists your role and, in plain words, what it lets you do. Change your own username and email there, always after confirming your password.

How it works

Four steps, in this order.

A sync only goes one way, from Google to AD. AD never changes anything in Google.

  1. Make your changes

    Add, edit or delete users and groups on the dashboard. They're saved to Google Workspace right away.

  2. Check the sync box

    It says Synced when AD matches Google, and Out of Sync when AD is behind.

  3. Preview the sync

    See everything that will be created, updated, moved or deleted. Nothing changes yet.

  4. Confirm

    Apply the sync. If new accounts were created, copy the temporary passwords. They appear only once.

Safe by design

Built so a sync can't surprise you.

Directory tools can do a lot of damage quickly. These are the habits GWS2AD builds in.

  • Backup first

    A copy of your Google users, groups and OUs is saved before each sync.

  • Empty OUs only

    OUs Google no longer has are deleted only when empty, never recursively, and never the base or the Domain Controllers OU.

  • Ignore list with notes

    Ignored items stay in AD, with a note on why, who added it and when.

  • Encrypted secrets

    Credentials live in an encrypted file. Nothing sensitive is kept in the code or the repository.

  • Audit trail

    Sign-ins, account changes, syncs and mode switches are all recorded.

  • Tested

    Eleven test suites cover permissions, sign-in, lockouts and full sync flows end to end.

Get started

Try it in five minutes.

It starts in Demo mode with a pretend company, so you can click through every screen without touching a real Google Workspace or Active Directory. You need Python 3.10 or newer.

git clone https://github.com/jonnytech-dev/gws2ad.git
cd gws2ad

python -m venv venv
# Windows:  venv\Scripts\activate      macOS/Linux:  source venv/bin/activate
pip install -r requirements.txt

python setup_secrets.py   # asks only for an Owner username and password
python app.py             # then open http://localhost:5000

When you're ready, a setting on the Connection page switches to your real Google Workspace and Active Directory. The README covers the Google and AD setup step by step.

Read the README View the code