AD Connect password sync stopped working to O365

[itbestuur (OHS-ITBestuur)]

I have problem in which I cannot sync passwords to O365, it looks like there is an issue with LDAP connection for my domain but not sure where to go from here. (screenshot attached)

Troubleshooting steps taken:​

• Asked Admin to rest the password, sync and try to sign in as that User but this was unsuccessful.​
• Ensured that the reset password check box was unticked.?​
• Used the command on the following case: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-trou… ​
  $adConnector = “” ​
  $aadConnector = “” ​
  Import-Module adsync ​
  $c = Get-ADSyncConnector -Name $adConnector ​
  $p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter “Microsoft.Synchronize.ForceFullPasswordSync”, String, ConnectorGlobal, $null, $null, $null $p.Value = 1 ​
  $c.GlobalParameters.Remove($p.Name) ​
  $c.GlobalParameters.Add($p) ​
  $c = Add-ADSyncConnector -Connector $c ​
  Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $false ​
  Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $aadConnector -Enable $true​
  **- Still no success.**​
• Tried refreshing the Schemer, still didn’t work. ​
• Did force Sync with Initial, showed updates but still could not get into the User account.​
• Got the Admin to update to most recent version https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aa but the issue was still present.​
  **- Ensured that the Admin had all the correct permissions for password Sync.**​
• Checked all settings that are contained within this link, which were fine: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-trou… ​
• Allowed replicate changes and replicate directory changes for all.​
• Created a new User and did a force sync. Attempted to sign in but still did not work.​
• When checking the event viewer, it came up with an error code, 611 (Image 1).​
• Started a fresh install of AD Connect on the server ensuring all settings were correct but it asked for a Service Controller​
• We still ran into the
  
  
  same error code.

[jitensh]

these steps will fix

https://www.matthiashuebner.com/index.php/2020/10/12/aad-connect-password-hash-synchronisation-failed/

[itbestuur (OHS-ITBestuur)]

As I mentioned in my post, those steps do NOT fix. But thank you for trying. Any other help would be kindly accepted.

[jitensh]

@itbestuur

As I mentioned in my post, those steps do NOT fix. But thank you for trying. Any other help would be kindly accepted.

The link I sent you has steps to

Solution

Open the Active Directory Users and Computers MMC.
Right-click on the domain root level and select Properties

Switch to the security tab and look for the user, which is used for Azure AD Connect replication. In my case, the user begins with MSOL_.

The user should have the “Replicating Directory Changes” and the “Replicating Directory Changes All” permissions.

→ then try force AAD sync.

we cannot see any of your links what you have tried it says 404 not found, why did you mark it as an unhelpful answer, if you have tried everything reach MS support,

[itbestuur (OHS-ITBestuur)]

The permissions are correct, I did check them. I have tried force sync.

I marked it unhelpful because I said all that in my original post.

I have contacted MS support and spoken to 2 technicians and they are struggling to solve the problem. The problem has now been escalated to Azure support at a higher level but still no solution. I was hoping someone here might have had this issue and can help solve it.

Thanks

[danuin]

Hi @itbestuur

We just had this same issue, I think. Does the Event Viewer on the AD Connect server showing anything like:
" Password hash synchronization failed for domain: *****.org, domain controller hostname: , domain controller IP address: . Details:
Microsoft.Online.PasswordSynchronization.SynchronizationManagerException: Unable to open connection to domain: *****.org."

IF it is, the new AD Connect Microsoft Entra Connect: Version release history - Microsoft Entra ID | Microsoft Learn 2.0.10.0 will fix that issue. I apologize if this is not the issue. I have a post up about this, too.

I hope this helps!

[raymondherman (Atom60m6)]

Since JitenSH recommendation didn’t work, did you try Danuin’s?
Also, if those still didn’t work… gotta ask, did you read the log event error?

Found this article about DC might not be configured right (not sure how many DC’s you have)…
“…The issue might be specific to a single domain controller, and pointing AADC to alternate DCs will let us test this out.”
IF that’s the case, maybe try looking at this article, Password hash synchronization agent is continuously getting RPC error from domain "" - Microsoft Q&A

Best of luck

@jitensh @danuin

[raymondherman (Atom60m6)]

Found this little tid-bit too…
“…I had to make sure the AD Sync user used was being synced with Azure AD also. It has to be in the correct OU.”
from [Azure AD Connect] Probelm hash sync password

[itbestuur (OHS-ITBestuur)]

@danuin

Hi OHS-ITBestuur

We just had this same issue, I think. Does the Event Viewer on the AD Connect server showing anything like:
" Password hash synchronization failed for domain: *****.org, domain controller hostname: , domain controller IP address: . Details:
Microsoft.Online.PasswordSynchronization.SynchronizationManagerException: Unable to open connection to domain: *****.org."

IF it is, the new AD Connect Microsoft Entra Connect: Version release history - Microsoft Entra ID | Microsoft Learn 2.0.10.0 will fix that issue. I apologize if this is not the issue. I have a post up about this, too.

I hope this helps!

Thank you Danuin! This worked. I did an in place upgrade to you version 2.0.10 and it worked!

What is weird is I downloaded my version 3 or 4 times this week from the official MS website, WITH the techs from MS assistance! Yet it was Version 2.0.9 up until I tried your download! Thank you.

So just to let everyone know, there was nothing wrong with any of the settings or passwords or accounts…it was Microsoft…

[danuin]

@itbestuur ​ - AWESOME! So glad I could help with this one.