Re-installing Entra Sync Connect fails due to Microsoft ADSync service getting stuck during the 'Starting' status

Tyler Gervase 0

Hello,

I am managing a HyperV Host with 2 VM's for an Educational client of mine. We have a DC & a SQL Server VM (for their education software).

I am having issues trying to reinstall Azure AD Sync/Entra Connect Sync onto my DC. Originally my issue stemmed from not being able to run a manual 'refresh directory schema' through Azure AD Sync - so I decided to upgrade to Entra Connect Sync v2.XX

Currently that has not gone well 😅 I am trying to install the tool via the latest Entra Connect Sync download from Microsoft, but when I go through the steps I until requiring the Microsoft 'AzureAD' service to run, but it gets stuck on the 'starting' status. I have tried quite a bit of troubleshooting so I'm kind of at my wits end.

Some steps I've taken are:

In-place upgrade: failed
Restarting DC: no change
Removing AzureAD/Entra & it's related programs via Control panel/Powershell and re-installing: failed
Trying to purge any and all lingering Azure/Entra settings that could be causing issues before re-installing: failed

I have an EventViewer log I think may be relatedhere:

ADSync Error ID 2005 - 3.2.25.txt

I have attached some logs below from my last 'fresh' install. Any help is appreciated!

Synchronization Service_Install-20250203-142628.log

SyncEngine-20250203-142409.log

ADSyncBootstrap-20250203-142521.log

1 answer

Marti Peig 960 Reputation points Microsoft Employee

2025-02-03T09:46:08.6933333+00:00

Hi @Tyler Gervase

Thanks for reaching out. Please check Resolve Model database corruption in SQLLocalDB and let us know if that resolved your issue.

As usual, if this answers your question, do click Accept Answer and Yes for what if this answer was helpful. And, if you have any further queries do let us know.

Cheers
Please sign in to rate this answer.
Tyler Gervase 0 Reputation points

2025-02-04T00:41:30.3133333+00:00

@Marti Peig Thank for your reply - but unfortunately that didn't resolve my issue

I checked through the logs referred to in that guide - I do not have logs within my Eventviewer for 'Application, EventID 528, Source: SQLLocalDB 15.0' or any error logs in my "<ADSync service profile path>.

I think there may have been an install incompletion/failure while running the AzureADConnect installer? I can see in my %sysvol%\Users folder is my expected users, but then I also have a 'TEMP' user created the minute after I tried to run the installer

Temp user.png

I have provided additional logs just after completing the recommended steps in 'Resolve Model database corruption in SQLLocalDB' if they are of any additional help.

Again, any assistance or input is really appreciated!

Event ID 6900 - ADSync error 29.1.25.txt

Event ID 2005 - ADSync error 4.2.25.txt

Event ID 6226 - ADSync error 4.2.25.txt

Event ID 906 - ADSyncBootstrap error 3.2.25.txt

Event ID 906 - ADSyncBootstrap error 3.2.25.txt

Kancharla Saiteja 385 Reputation points Microsoft Vendor

2025-02-04T06:35:54.8+00:00

Hi @Tyler Gervase ,

I see @Marti Peig has provided you the respective document to resolve the error but found you have some queries in resolving the issue. I would like to provide you additional information based on the errors provided. I see there is an error of AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication which means there is conditional access policy which is requesting MFA for your AdSync cloud account. Since the account works non interactive authentication and will not be able to accomplish the MFA. In this situation kindly make sure to exclude your Cloud Service account. You can find the cloud service account of Entra connect in audit logs by filtering logs with Entra connect.

Once you find the service account, go to conditional access policy and click on "WhatIf" and check the policies that are getting applied to the account and exclude accordingly.

I have also seen an error where it states about the credentials of the service account. Make sure you follow this document to ensure there is no password issues.
Here is the official document of troubleshooting sync service failed to start: https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/directory-sync-stop-register

Here are the permissions that are necessary for AD Sync Service account.

Make group policy changes if necessary, so that the AD Sync service account can log on locally, as a service, and as a batch job. Because a domain group policy takes precedence over a local group policy, you need to check the settings for both types of group policies.

Select Start, enter gpedit.msc in the search box, and then press Enter to open the Local Group Policy Editor snap-in.

In the console tree, under Computer Configuration, expand Windows Settings > Security Settings > Local Policies, and then select User Rights Assignment.

Verify that the ADSync service account is added for the following policy settings:

Allow log on locally

Log on as a batch job

Log on as a service

For domain group policies, open an administrative command prompt.

Run the following gpresult command, which generates a group policy report:

gpresult /H gpresult.htm

Open the resulting group policy report (gpresult.htm).

If User Rights Assignment settings are applied through any domain group policy object (GPO), use the Group Policy Management console (gpmc.msc) from a domain controller to take one of the following actions:

Remove the following policy settings from the Winning GPO:

Allow log on locally

Log on as a batch job

Log on as a service

Update the Winning GPO to include the ADSync service account.

If you made any changes to the local group policy or domain group policy, restart the computer to apply the changes.

If above steps doesn't help then you will have to open internet ports for AD connect server to connect with Azure endpoints on internet.Make group policy changes if necessary so that the ADSync service account can log on locally, as a service, and as a batch job. Because a domain group policy takes precedence over a local group policy, you need to check the settings for both types of group policies.

Select Start, enter gpedit.msc in the search box, and then press Enter to open the Local Group Policy Editor snap-in.

In the console tree, under Computer Configuration, expand Windows Settings > Security Settings > Local Policies, and then select User Rights Assignment.

Verify that the ADSync service account is added for the following policy settings:

Allow log on locally

Log on as a batch job

Log on as a service

For domain group policies, open an administrative command prompt.

Run the following gpresult command, which generates a group policy report:

gpresult /H gpresult.htm

Open the resulting group policy report (gpresult.htm).

If User Rights Assignment settings are applied through any domain group policy object (GPO), use the Group Policy Management console (gpmc.msc) from a domain controller to take one of the following actions:

Remove the following policy settings from the Winning GPO:

Allow log on locally

Log on as a batch job

Log on as a service

Update the Winning GPO to include the ADSync service account.

If you made any changes to the local group policy or domain group policy, restart the computer to apply the changes.

If none of the above help you in resolving the issue, kindly install the Azure Ad connect on new server which is domain joined and windows server 2019 or above version.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Kancharla Saiteja 385 Reputation points Microsoft Vendor

2025-02-05T05:29:57.2866667+00:00

Hi @Tyler Gervase ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Kancharla Saiteja 385 Reputation points Microsoft Vendor

2025-02-06T03:59:37.7733333+00:00

Hi @Tyler Gervase ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Tyler Gervase 0 Reputation points

2025-02-06T07:51:41.9066667+00:00

Hi @Kancharla Saiteja ,

Sorry for the delay. I have tried those steps and unfortunately still no success :(

I think before I can even test the sync/make connection to Azure Online I still need the ADSync service to start & run - but it gets stuck in the 'starting' status.

I am still investigating the issue. Any further advice is appreciated.

Kancharla Saiteja 385 Reputation points Microsoft Vendor

2025-02-06T08:18:59.93+00:00

Hi @Tyler Gervase ,

Thanks for your response.

I believe you are receiving the issue because service account might not be able to authenticate with your DC or the service account does not have necessary permissions. Since you have already check with the permissions on the issue, could you please try to install new AD connect on a different server which is domain joined and able to connect in the same network with your Domain controller. This might create a clear connection with your DC and helps service account to authenticate with DC. I suggested new server to avoid any cache or previous installed information of AD connect might affect the current configuration.

Please check the above information and let me know the results by responding in comments.

Kancharla Saiteja 385 Reputation points Microsoft Vendor

2025-02-07T03:50:29.8533333+00:00

Hi @Tyler Gervase ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Re-installing Entra Sync Connect fails due to Microsoft ADSync service getting stuck during the 'Starting' status

1 answer

Your answer