Troubleshoot Azure Active Directory Sync tool installation and Configuration Wizard errors

This article describes how to troubleshoot Azure Active Directory Sync tool installation and Directory Sync tool Configuration Wizard issues.

Original product version:   Microsoft Entra ID, Microsoft Intune, Azure Backup, Office 365 Identity Management
Original KB number:   2684395

Introduction

This article provides resolutions and common causes of error messages that may occur when you install or set up the Directory Sync tool.

Check system requirements

The Azure Active Directory Sync tool can be installed on a computer if all the following conditions are true:

• Windows PowerShell 1.0 is installed on the computer.
• You're logged on to the computer as a member of the local Administrators group.
• The computer has a 64-bit processor.
• The computer is running one of the following operating systems:
  • Windows Server 2003 x64 with Service Pack 2 (SP2) or a later version
  • An x64-based version of Windows Server 2008
• The computer isn't a domain controller.
• The computer is joined to an Active Directory domain. And it's located in the forest that you want to sync with Microsoft Entra ID.
• The Microsoft .NET Framework 3.5 or a later version is installed on the computer.

Check permissions

To start the Directory Sync tool Configuration Wizard successfully, users who log on to the computer on which the Directory Sync tool is installed must be a member of the local Microsoft Identity Integration Server (MIIS) Admins group that was added during installation of the tool.

When you run the Directory Sync tool Configuration Wizard, you must provide the following information:

• Enterprise admin credentials for the on-premises Active Directory schema
• Global admin credentials for the Microsoft cloud service

Check domain connectivity by using nltest

Nltest is a command-line tool that is built into Windows Server. It is available as part of the Remote Server Administration Tools for Windows 10.

• To check the domain controllers of the domain, run the following command at the command prompt:

  nltest /dsgetdc:<FQDN of the domain>
  

  Note

  The nltest tool requires installation of the Windows Server 2003 Support Tools.

  If the settings are correct, the output resembles the following example:

  DC: \DC.contoso.com 
  Address:\ <IP Address> 
  Dom Guid: <GUID> 
  Dom Name: contoso.com 
  Forest Name: contoso.com 
  DC Site Name: Default-First-Site-Name 
  Our Site Name: Default-First-Site-Name 
  Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE 
  The command completed successfully
  

• To check the computer's site membership, run the following command at the command prompt:

  nltest /dsgetsite
  

  A successful result resembles the following example:

  Default-First-Site-Name 
  The command completed successfully
  

Error 1: The computer must be joined to a domain

To troubleshoot this issue, check the domain membership of the computer by following these steps:

1. Log on to the computer.
2. Right-click My Computer, and then select Properties.
3. Select the Computer Name tab. If the computer is a domain member, the Full Computer Name resembles ComputerName.Domain.xxx. The domain name appears next to Domain.

If the computer is a domain member, and you still receive the error message, verify that:

• The computer can communicate with the domain.
• The computer can discover the domain controller.

To do so, follow these steps:

1. Use the ipconfig command-line tool to check the Domain Name System (DNS) settings on the server.

2. Confirm that you can ping the DNS server that's listed in the network properties on the problem computer.

3. Run the nslookup command-line tool. If the DNS server is unreachable, you receive an error message. For example, you receive an error message that resembles the following example:

   DNS request timed out.
   timeout was 2 seconds.
   *** Can't find server name for address <IP Address>: Timed out
   Default Server: UnKnown
   Address: <IP Address>

Sometimes, joining the computer to a workgroup, and then joining the computer back to the domain may resolve this error message. If the computer can't join the domain, it indicates one of the following problems:

• The computer is experiencing an issue in contacting the domain controllers.
• The Active Directory domain is rejecting the request.

Error 2: The Azure Active Directory Sync Tool is already installed

In this case, the Directory Sync tool may not be installed because of a previous pending installation. The Setup package also installs software in the background during installation. To resolve this issue, follow these steps:

1. In Control Panel, check whether Microsoft Identity Integration Server is listed in Add or Remove Programs or in Programs and Features. If it's present, you must remove it.
2. Verify that the Program Files folder contains a subfolder that's named Microsoft Identity Integration Server. If the subfolder exists, you must rename the folder to Microsoft Identity Integration Server_Old.
3. Run Setup again.

Troubleshoot other error messages

All directory synchronization logging is viewable in Event Viewer. To view all events that are related to directory synchronization, follow these steps:

1. Open Event Viewer.
2. Expand Windows Logs, and then expand Application.
3. In the Actions pane, select Filter Current Log.
4. In the Event sources box, select the Directory Synchronization check box.
5. Select OK. The following table lists the error name, the error details, the error source, and the steps to help resolve the error.

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.