0

So we have a need to change the password on one of our service admin accounts. However, one of the side-effects of changing that password is that it broke Azure AD password sync.

We first changed the password on the account, via the Active Directory Users and Computers interface. Then, according to the microsoft documentation, we changed the connector account password. (when we originally broke it, the Azure AD connect diagnostics pointed us at this connector account).

However, this doesn't work. We even tried creating another service account for this, added the credentials to AD Connect, and changed the old password.

We're clearly missing a step here though, so what could we be missing? I suspect that this account is tied to some other stuff, so a starting point would be good.

To add to the mix, we don't know the Azure AD Sync Service account password, so we can't get into the connector app.

Scuba Steve
  • 149
  • 3
  • 9

1 Answers1

2

To add to the mix, we don't know the Azure AD Sync Service account password, so we can't get into the connector app.

I don't understand what you mean. You don't need to know the service account password to launch the Azure AD Connect Synchronization Service console. Try this:

On your Azure AD Connect server launch the Azure AD Connect Synchronization Service console.

Switch to the Connectors tab.

Select the local Active Directory Domain Services connector.

Click Properties in the Action pane.

Select the “Connect to Active Directory Forest” setting.

Enter the new password into the password field and click OK.

Open an elevated Powershell prompt and type the command “Import-Module ADSync” and press enter.

Type “Start-ADSyncSyncCycle -PolicyType Delta” and press enter.

In the Azure AD Connect Synchronization Service console switch to the Operations tab and watch the sync cycle. If it's successful, you'll see it. If not, you'll see why.

joeqwerty
  • 108,377
  • 6
  • 80
  • 171
  • Yeah I actually managed to get into the AD Connect Sync Service console by adding a user to the correct security group, and then doing a logout/login. I'll make an attempt with these steps and update. – Scuba Steve May 31 '19 at 22:22
  • 'The term Start-ADSyncSyncCycle is not recognized...' – Scuba Steve May 31 '19 at 22:26
  • Okay, turned out I didn't need to force the sync cycle to start. All is well now. Thank you! – Scuba Steve May 31 '19 at 22:35
  • Turns out I was also able to get the Start-ADSyncSync cycle job to run in powershell, but I had to be in the ADConnect directory. – Scuba Steve Jun 01 '19 at 00:06