Dealing with AD sync issues in an Azure hybrid deployment

author Rik Hepworth calendar Nov 5, 2013 · 2 min read · Uncategorised  ·
Share on: linkedin copy

I’ve been building demo environments for Tech.Days Online for the past few days. I had been blogging as I built, but then I hit problems and time pressure meant I had to pause my series on building the hybrid network. I will pick up the remainder of those posts in the near future but in the meantime, I want to give you all the heads up on one of my problems.

When I came to install the directory synchronisation tool on my azure-hosted dirsync server I couldn’t get the configuration wizard to run. It kept telling me that the domain admin user I entered (the domain administrator!) was not a valid domain account. I tried removing the machine from the domain and re-adding it first to no avail, and then started looking at domain replication.

There were no errors in the event log, save for one solitary warning on each DC about time. DCDIAG spat out huge lists of errors on both servers. Repadmin refused to admit that the domain controllers knew about each other.

So, for ref, I was seeing:

  • RPC errors when trying to talk between domain controllers.

  • DNS servers were not synchronising.

  • DCDIAG on one server threw up range of errors:

  • EventID: 0x80000B46 related to kerberos.

  • EventID: 0x00001695 relating to failed registration of DNS addresses in the domain.

  • EventID: 0x00001695 relating to failed registration of DNS addresses in the ForestDNSZones subdomain.

  • EventID: 0x00001695relating to failed registration of DNS addresses in the DomainDNSZones subdomain.

  • EventID: 0x0000168E relating to failed registration of the DNS record _ldap._tcp.ForestDnsZones.

  • EventID: 0x0000271A relating to a failed DCOM registration.

The solution was to fix time on the domain. I ran through a number of articles on the subject, and at the back of mind was a recollection that time can drift when running in a VM.

In the end I followed the settings in this TechNet article. I set both domain controllers to sync time with an NTP source (time.windows.com) and ten left the whole thing to settle for an hour or so while we went for food. When I came back the domain had settled.

Sadly, my dirsync box was a casualty of the conundrum. Because I removed it from the domain while AD sync was not working I had a broken trust relationship. I removed it for the domain again, rejoined it and everything worked just fine.

As always, hopefully this will save somebody some time and grief when doing the same thing as I was.