1

Hi Ladies & Gentlemen,

I have an issue in which I cannot sync passwords to O365, it looks like there is an issue with LDAP connection for my domain but not sure where to go from here. (screenshot attached)

Troubleshooting steps taken:​

  • Asked Admin to rest the password, sync and try to sign in as that User but this was unsuccessful.​
  • Ensured that the reset password check box was unticked.?​
  • Used the command on the following case: Troubleshoot password hash synchronization with Microsoft Entra Connect Sync - Microsoft Entra ID | Microsoft Learn? ​
    $adConnector = “” ​
    $aadConnector = “” ​
    Import-Module adsync ​
    $c = Get-ADSyncConnector -Name $adConnector ​
    $p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter “Microsoft.Synchronize.ForceFullPasswordSync”, String, ConnectorGlobal, $null, $null, $null $p.Value = 1 ​
    $c.GlobalParameters.Remove($p.Name) ​
    $c.GlobalParameters.Add($p) ​
    $c = Add-ADSyncConnector -Connector $c ​
    Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false ​
    Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $true​
  • Still no success.​
  • Tried refreshing the Schemer, still didn’t work. ​
  • Did force Sync with delta, showed updates but still could not get into the User account.​
  • Got the Admin to update to most recent version https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aa but the issue was still present.​
  • Ensured that the Admin had all the correct permissions for password Sync.​
  • Checked all settings that are contained within this link, which were fine: Troubleshoot password hash synchronization with Microsoft Entra Connect Sync - Microsoft Entra ID | Microsoft Learn ​
  • Allowed replicate changes and replicate directory changes for all.​
  • Created a new User and did a force sync. Attempted to sign in but still did not work.​
  • When checking the event viewer, it came up with an error code 1127, 611 (Image 1).​
  • Started a fresh install of AD Connect on the server ensuring all settings were correct but it asked for a Service Controller​
  • We still ran into the same error code.

Please look at my screenshots!

any help is much appreciated!

THANKS IN ADVANCE!

error.png
error.png800×460 191 KB
event_viewer.png
event_viewer.png800×452 130 KB

error.jpg
error.jpg1319×759 166 KB
2 Spice ups
2

Is the Sync tool up to date ?

2 Spice ups
3

Thank you for replying to my post.

We have removed the sync tool and installed a clean copy. Checked the permissions on the directory, but the password sync does to work.

Sync tool was installed on another box which did not resolve the problem.

4

Is the problem with one account or all the accounts? You can see if the account is disabled anywhere.

1 Spice up
5

If I create a new account, it will not sync the passwords, also if I update somebody’s password it will not sync up.

6

While configure Azure AD Connect, did you create a new service account or did you use the existing one? The admin user you are using while configuring the AAD Connect is not the same account that the sync service is using. When you configure AAD Connect, it will create a user MSOL_xxxxx that is used to run the sync. Does that use have the correct rights to disk?

3 Spice ups