We help IT Professionals succeed at work.

On Azure AD connect server- DeltaSync - status , no-start connection. At the connection status tab, Status - failed connection

289 Views
Last Modified: 2020-10-15
Hi

Users from on Prem AD is not syncing with 0365
On the Azure AD connect server,  I did a DeltaSync
When it Syncs it says on the status , no-start connection. At the connection status tab, if I click the connector name and on the connection log window.
Status - failed connection
Server ADC-002:389
Error :Server Down
Error Code0x51
Status-Failed connection
Server - Domain. Local
Error :The specified domain either does not exist or could not be contacted
Error code :1355

We have 3 domain controllers, ADC-001,ADC-002 and ADC-003 and nothing thing was changed and this problem has started all of sudden.
Any help to troubleshoot and resolve would be great.

Thanks
Comment
Watch Question

MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Seems to be dns issue

This is may be due to ip configuration issue
OR
Network connectivity issue from ad connect server

Author

Commented:
Please post as how to trouble shoot and resolve this issue.

Thanks
NoahHardware Tester and Debugger
CERTIFIED EXPERT

Commented:
Hi there! :)

Please refer to the link below for an article with step by step instructions on how to fix problems with directory synchronization for Office 365.

Reference: https://docs.microsoft.com/en-us/office365/enterprise/fix-problems-with-directory-synchronization
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Hi Lianne,

Can you check if the internet connectivity is there on AAD Connect Server?
and also check what proxy server you have configured in your Azure AD Connect Server

Author

Commented:
Hi Rohit

Internet is working fine on the AAD connect server  and also on our Domain controller that is allowed to sysc with the Azure AD connect server.

Also on the Azure AD connect server , there is no proxy setting.
We use transparent proxy on our DC

Is there a way to check the connectivity between Azure AD Connect server and our Domain controller ?

Thanks
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Hi Lianne, Can we work over remote? Do let me know, i will send you skype invite
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:

Author

Commented:
I tried to ping from the aad connect server to the IP of our Domain controller  and it gives request time out  and also did a trace route on from the aad connect server to our domain controller IP .
Both results gives request time out .

Author

Commented:
Firewall team is hosted out side  our organisation and not sure what i need to ask them to check?
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Hi Lianne,

Do you have Azure AD Connect Staging Server in place?
Cloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Thanks Rohit
I try to install a staging server and this means installing AAD connect on a member server and try syncing?
Please see the attached error ion the Synchronisation service manager.
synchronisation-service-manager-erro.png

Author

Commented:
This was a working setup and suddenly the sync stopped  and not sure where it could have gone wrong.
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
It looks something is getting block..

So for mitigating the issue at this moment, you can install Azure AD Connect Staging Server and then you need to Stop Azure AD Connect Service on the primary server and to make staging server as primary and run the sync
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-staging-server

Author

Commented:
Thanks so much!

Ok,

Firstly  After installing the Azure AD Connect Staging Server on a member server , if the sync is working , what could be the problem on the primary server ?

Secondly if the sync is still not working even on the staging server what could be the problem ?
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
I dont think, so it will not work.. As I said, we need to have multiple tracing needs to be done.. Not sure, if any recent changes has been implemented from your network or Security teams..

So, At this stage, Just try to build this staging server.. If it will not work, we need to rebuild primary AD COnnect Server

Author

Commented:
Hi

I didn’t install the staging server and was investigating this further and when I went to the AD connect server  and Synchronisation services manager and when I click the failed connection,

The connection Log opens and gives the errors as ADC-002.domain.local :389 is down.

I went to the AD connect server and opened the DNS server and please see the snap shot as shown.
On the Forward Look up Zones – Domain .Local
10.14.108.46  is unable to resolve  and this is the IP address of ADC-002.domain.local ( Secondary Domain controller)

Please suggest how to troubleshoot this issue as a where the problem is and resolve this issue.

Thanks
No-Start-connection-error.png
AD-Connect-DNS-server-SRV-records-er.png

Author

Commented:
I restarted the AD connect server  and no joy .
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
This looks that Azure AD Connect is not able to do LDAP query to DC...
https://docs.microsoft.com/en-in/azure/active-directory/hybrid/reference-connect-ports

Can you let me know the DC server version ... is it windows server 2008 r2

Can you check the below steps suggested in community post
https://social.technet.microsoft.com/Forums/office/en-US/d694dd43-41db-45d8-b84a-c823e450c146/server-did-not-respond-to-ldap-query-to-port-389-udp
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Hi Lianne,

I will request you to do below connectivity test check from your Azure AD Connect Server
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-adconnectivitytools#adconnectivitytool-during-installation

Please follow the steps suggested in above docs

Author

Commented:
The server version is Windows 2012 R2 Standard

Author

Commented:
Firstly As per the link provided below.
https://docs.microsoft.com/en-in/azure/active-directory/hybrid/reference-connect-ports

Table 1 and Table 2  does these ports needs opened on our firewall for our Local Active directory server ADC-002.Domain.local
or the public facing IP?

Is there any commands or way to check from AD connect server if each these ports are opened or not .
By this i can ask the firewall team to open any specific ports if it is blocked.
This was a working setup from last 1 year and hope the Firewall rule for this setup much be present. But still we can double check the ports if opened or not.

Secondly i am not confident running the connectivity test from the AD connect server to ADC-002.domain.local .
Please can you post me step by step instructions as how to execute this command.
Thanks
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Did you run this connectivity check as suggested in below URL
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-adconnectivitytools#adconnectivitytool-during-installation

In the azure ad connect server, go to the below file path and run the tool
The tool is located in: C:\Program Files\Microsoft Azure Active Directory Connect\Tools\ ADConnectivityTool.psm1

Capture24.JPG
This will let you know, if any port is blocked in between Azure AD Connect Server and your DC server

Author

Commented:
Thanks

So I assume that i open PowellShell on the AD connect server - Copy and paste the following command  and it must bring the results for the connectivity between the AAD connect server an dour local domain controller (ADC-002.domain.local)

C:\Program Files\Microsoft Azure Active Directory Connect\Tools\ADConnectivityTool.psm1

Before i run , do i need to change any values on the ADConnectivityTool.psm1 file?
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Hey, you just need to provide the directory information which you was configured to sync using AZure AD Connect to test out..  refer the snapshot

Author

Commented:
As per the link provided below for Table 1 and Table 2  
I tried the connectivity test using the following powershell command from the AD connect server. Please see the attached results.

New-Object System.Net.Sockets.TcpClient("193.x.x.x", Port no)
New-Object System.Net.Sockets.TcpClient("10.x.x.x", Port no)

 Does these ports needs opened on our firewall for our Local Active directory server ADC-002.Domain.local
or the public facing IP address or Both ?
Also not sure which port no i should use for RPC ?
Please suggest.

https://docs.microsoft.com/en-in/azure/active-directory/hybrid/reference-connect-ports
0365-Ports-on-FW.xlsx
Rohit AnandCloud Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Thanks for your help!
Sorry couldn't respond sooner.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.