Fresh install to a 2012R2 VM using AzureADConnect.exe /migrate, using the exported configuration from existing DirSync server v1.0.6862.0 for running in parallel. I only have to enter three credentials. One for the global admin, one for the enterprise admin and one for the service account. I've logged in with all three of these credentials and still cannot figure out which account it is complaining about.
Below is the log where I'm getting an error that username or password is bad. MSOL account gets created, remote SQL database is created. Scheduled task gets created, local groups get created and
[08:27:59.818] [ 18] [INFO ] Synchronization account will have account name <MYDOMAINNAME>\MSOL_6e2057dab686
[08:28:00.062] [ 18] [INFO ] Synchronization account was created successfully.
[08:28:00.180] [ 18] [ERROR] Caught exception while creating synchronization account.
Exception Data (Raw): System.Security.Authentication.AuthenticationException: The user name or password is incorrect.
---> System.DirectoryServices.DirectoryServicesCOMException: The user name or password is incorrect.
at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.PropertyValueCollection.PopulateList()
at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
--- End of inner exception stack trace ---
at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
at System.DirectoryServices.ActiveDirectory.DirectoryEntryManager.ExpandWellKnownDN(WellKnownDN dn)
at System.DirectoryServices.ActiveDirectory.Domain.GetDirectoryEntry()
at Microsoft.Online.DirSync.Common.DirectoryServicesAdapter.Domain.GetDirectoryEntry()
at Microsoft.Online.DirSync.Common.DomainAccountUtility.UpdatePermissionsOnDomains(DomainCollection domains, SecurityIdentifier sid, AccessControlEntryUpdateAction actionType, ActiveDirectoryRights accessType, Guid accessRightsGuid, Boolean applyToAdminSDHolder,
Guid inheritedObject, ActiveDirectorySecurityInheritance inheritanceType)
at Microsoft.Online.Deployment.Types.ActiveDirectoryPermissionsHelper.UpdateAccessRightsOnAllDomainsInForest(NetworkCredential domainAdminCredential, String samAccountName, AccessControlEntryUpdateAction accessControlEntryUpdateAction, ActiveDirectoryRights
accessType, Guid accessRightsGuid, Boolean applyToAdminSDHolder, Guid inheritedObject, ActiveDirectorySecurityInheritance inheritanceType)
at Microsoft.Online.Deployment.Types.Providers.SyncDataProvider.GrantAllActiveDirectoryPermissions(NetworkCredential enterpriseAdminCredential, String syncAccountName)
at Microsoft.Online.Deployment.Types.Providers.SyncDataProvider.CreateSynchronizationAccount(NetworkCredential domainAdminCredential, String installationIdentifier, String tenantDisplayName)
at Microsoft.Online.Deployment.OneADWizard.Runtime.Stages.ConfigureSyncEngineStage.StartADSyncConfigurationCore(IPersistedStateProvider persistedStateProvider, EventHandler`1 progressChanged, Guid& currentActivityType)
[08:28:00.236] [ 18] [INFO ] ConfigureSyncEngineStage.StartADSyncConfiguration: AADConnectResult.Status=Failed
[08:28:00.238] [ 18] [INFO ] Updating state of activity ConfigureSyncEngineForPwdSync from InProgress to Failed
mike
hi
I get a something went wrong error when trying to join any windows 10 Enterprise machines to AAD.
The error message doesn't tell me a lot (something went wrong). I can't attache a screenshot, as I have to verify my account.
In Azure, I have under Devices: Users may join devices to azure ad -> All
Users may Register their devices with azure ad -> All is selected but greyed out
In Intune, admin-mdm - mdm device Management authority -> set to Microsoft intune.
Has anyone any ideas?
Thanks
Noel
***** This posting is provided "AS IS" with no warranties, and confers no rights.
Hi,
As the title says... It is supported to change/reduce the default schedule of the "Azure AD Sync Scheduler" task created by AADSync in a hybrid Exchange environment? I would like to reduce drastically the time between runs of this task so I can be sure that if a password change occurs on-prem then no more than lets say 10 minutes will pass between syncs.
Thanks.
hi,
An web application URL has been registered with Azure AD hence users are redirected to Azure login and able to authenticate using Azure AD credentials when accessing these web URLs via browsers. However, users are also able to enter their personal live id to reach the application page as well. Currently, users using their personal live id would see application error as applications check for authorization against their username.
Hence, I would like to check if this is the expected correct behavior. The authorization to web applications would be handled within applications.
Or are Azure AD administrators able to configure and lockdown further during application registration with Azure AD. Thanks
I'm having problems enabling our Domain services.
I chose dns domain name in form azure.ourdomain.com (our was exactly 15 letters) and I added it to existing Azure network which is in North Europe, so it should be enabled. The process runs for 1,5 hours and the slider goes back to "No" without any error messages. If I try to change network and try to run it again, it gives a message "Unable to save Domain Services settings". Any ideas?
Hi,
We have change password functionality which had been working till now, but all of sudden it stopped working and throwing "Insufficient Privileges Exception".
The user am trying to change the password is in "User" role in AD. and I have enabled all the Application Permission and Delegated Permission.But Still I am getting the error.Please look at the below code on How I am acquiring the token.
// Instantiate an AuthenticationContext for my directory (see authString above). AuthenticationContext authenticationContext = new AuthenticationContext(GetConfigValue(Constants.AuthString), false); // Create a ClientCredential that will be used for authentication. // This is where the Client ID and Key/Secret from the Azure Management Portal is used. ClientCredential clientCred = new ClientCredential(GetConfigValue(Constants.ClientID), GetConfigValue(Constants.ClientSecret)); // Acquire an access token from Azure AD to access the Azure AD Graph (the resource) // using the Client ID and Key/Secret as credentials. AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(GetConfigValue(Constants.ResAzureGraphAPI), clientCred); AccessToken = authenticationResult.AccessToken; // Return the access token. return authenticationResult.AccessToken;
I have tried installing the most recent Azure AD connect on 3 different Windows Server 2012 R2 VM's. The installation gets all the way to the point where it is creating the local AD sync account, then fails with an error that the password doesn't meet password requirements. I have changed the Default Domain Policy GPO to no complexity/0 passwords remembered/6 characters AND back to complexity/8 characters/24 passwords remembered. I ran GPUPDATE on the DC and installation VM after each GPO change, but the installation continues to fail. Anyone experience this or have any ideas?
Thank you for any advice.
[11:38:08.547] [ 10] [INFO ] Synchronization account will have account name XXXXXXXXXXX.LOCAL\MSOL_a0966afb0e72
[11:38:08.727] [ 10] [ERROR] Caught exception while creating synchronization account.
Exception Data (Raw): System.DirectoryServices.AccountManagement.PasswordException: The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements. (Exception from HRESULT:
0x800708C5) ---> System.Runtime.InteropServices.COMException: The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements. (Exception from HRESULT: 0x800708C5)
--- End of inner exception stack trace ---
at System.DirectoryServices.AccountManagement.ADStoreCtx.Insert(Principal p)
at System.DirectoryServices.AccountManagement.Principal.Save()
at Microsoft.Azure.ActiveDirectory.Synchronization.Framework.AccountManagementAdapter.CreatePrincipalCore(Principal principal)
at Microsoft.Azure.ActiveDirectory.Synchronization.Framework.AccountManagementAdapter.CreateUser(String userSamAccountName, SecureString userSecurePassword, String userDescription, Boolean userPasswordNeverExpires)
at Microsoft.Online.Deployment.Types.Providers.SyncDataProvider.CreateSynchronizationAccount(NetworkCredential domainAdminCredential, String installationIdentifier, String tenantDisplayName)
at Microsoft.Online.Deployment.OneADWizard.Runtime.Stages.ConfigureSyncEngineStage.StartADSyncConfigurationCore(IPersistedStateProvider persistedStateProvider, StatusChangedDelegate progressChanged)
[11:38:08.728] [ 10] [INFO ] ConfigureSyncEngineStage.StartADSyncConfiguration: AADConnectResult.Status=Failed
From Mikehole @mikehole via Twitter
So because I'm using an AzureAD joined machine with the same email as my primary email I can't add that email account to the Win10 Email app.
https://twitter.com/mikehole/status/664376161011658752
Thanks,
@AzureSupport
Thiene Schmidt
hi,
I want get users from azure by using ActiveDirectoryClient.
But it only return 100 uses.
My ActiveDirectoryClient version is 2.0.6(Microsoft.Azure.ActiveDirectory.GraphClient.2.0.6).
How can i do with this?
my code is:
retrievedUsers = activeDirectoryClient.Users.ExecuteAsync().Result.CurrentPage.ToList();
Hi all,
I've already asked this on Office 365 Community Forum http://community.office365.com/en-us/f/613/t/267826.aspx.
Our scenario: we have a multi-forest environment due to a recent merger, with one forest with resources and some accounts and another forest with accounts only that should be migrated to the first one during time. We're at Wave 15 on our tenant.
We're configuring AAD Sync Service, but we need to choose the attribute to use as sourceAnchor; we think that the approach suggested in http://blog.msresource.net/2014/03/10/windows-azure-active-directory-connector-part-3-immutable-id/ should work.
In short:
Should that work? How can we get the tool to write back the sourceAnchor value to mS-DS-ConsistencyGuid?
Thanks
We have an requirement to send a unique identifier as userid@domainname.com as part of SAML token. Our current AD contains over 100 domain which cannot be accomodated as valid domain on the application as it exceed their limit. So sending the email or UPN seems like not an option.
Does Azure allow to concatenate any string as part of attribute. May be user.onpremisessamaccountname+"@Domainname". IS this a possibity while setting up the SSO configuration?
Please let me know if you need any additonal information that can help answer the question.
Thanks,
Gayatri
I have a very urgent question to ask. My client has ADFS v2 already in production and married to Azure AD. When users try to sign into Azure, they get redirected to ADFS v2 for authentication.
I have installed Azure AD Connect at client site in staging mode. In the User Sign-In screen, I selected “Do not configure” because they already have ADFS and also want to do all authentication in ADFS. We don’t want to disturb that setup.
Now, client is requesting to also sync Passwords to Azure AD for backup purposes before we take out AAD Connect from staging mode. I ran the AAD Connect wizard again to customize the settings. “Password hash synchronization” box is disabled!
How do I enable password hash synchronization in this situation? Please help!
Hello Experts,
how to differentiate between on premise user and cloud user azure ? I mean which property in user entity can tell me if user is synced from On Premise AD or in Azure AD.
I am confused whether to user dirSyncEnabled or immutableId.
or there is some other way. Please provide some guidence.
Thanks,
Ritesh
After login through azure active directory, a user should be able to see his own data. How should I control what a user can access after login using azure active directory.
Thanks for Santhosh's reminding. Here is some update info. So I have an desktop application and I use azure active directory to manage authentication for my application. I want to give each user a specific folder or any kind of resources. The thing is the resources has to be related to the specific user and other people can not see it for security reason. My question is: is there any way to do it using some services provided by azure? If that is not possible, what should I do with coding?
Updating: An application would have more than one level of data access rights. I need a way to specify the levels a user can access. For example, I have three levels of data in my application: basic articles, advanced articles and new articles. I want to assign user A level 1 and 2 (basic and advanced articles) and I want to give user B the access to just level 1 (basic articles). What could I do with azure active directory?
Hi Everyone,
I have successfully installed Azure AD Application Proxy Connector on my server. When I run the troubleshooter, I see updater is failed in the report
"Connectivity to update service failed
<dir><dir>Error connecting to URL: 'https://updater.msappproxy.net:8080/'. Error: 'The operation has timed out'. Make sure firewall and proxy configuration are properly and that the necessary outgoing ports are open – see http://go.microsoft.com/fwlink/?LinkID=401510"
</dir></dir>I tested with telnet with command "telnet https://updater.msappproxy.net 8080", it connects successfully. Also if I puthttps://updater.msappproxy.net:8080 URL in my web browser, I see successful connection and am also able to see the certificate which also confirms the connection.
Is this a false positive or something that needs to be fixed?
Thanks in advance!
Hello!
My Azure AD Connect sync has failed. I noticed a lot of failures over the last week and now see an alert in O365 that nothing has been in sync for 3-days. I can't upload images so here's what is says:
Active Directory synchronization: DeactivateDirectory Sync | ManageDirectory Sync | Warning: Last synced more than 3 days ago | Troubleshoot about Directory Sync
When I try to run the Microsoft Azure Active Directory Connect configuration tool it only complains of a generic error and to hit the forums!
Please see the attached Log:
[14:08:22.386] [ 1] [INFO ]For applications that authenticate directly against ADFS, we can bypass MFA for "registered devices".
Are there any plans to extend this capability for Azure MFA when authenticating against Azure AD? Ideally we would like to be able to bypass MFA for on-prem domain-joined devices (Windows) and Azure AD workplace-joined devices (Android)
While the "trusted ips" capability in Azure MFA would be sufficient for most organisations, 80% of our fleet are on mobile devices outside of the corporate network, so this feature is of limited value to us.