Error while trying to install Microsoft Entra Connect on my passive server at the DR site

PRADEEP KOCHUVEETTIL MADHAVAN 20 Reputation points
2026-11-06T05:15:46.54+00:00

Hi,

I am encountering an error while trying to install Microsoft Entra Connect on my passive server at the DR site. The production Entra Connect server is working without any issues.

Background:

Microsoft Entra Connect was previously installed on this DR server. When I attempted to upgrade it to version 2.6.92.0, the upgrade failed with the following errors:

[ERROR] TryConfigureApplicationAuthenticationInteractiveUpgrade::

Failed to set up application authentication. ExitCode: 98

[15:47:51.352] [38] [ERROR] ConfigureSyncEngineStage:

ABA configuration failed during interactive upgrade.

After several unsuccessful troubleshooting attempts, I decided to completely uninstall Microsoft Entra Connect and perform a fresh installation on the passive server.

I uninstalled the application and manually cleaned up the remaining Entra Connect-related files from the Program Files and ProgramData directories.

However, during the fresh installation, I am now encountering another error at the AD DS connection/configuration stage, which prevents the installation from proceeding.

Current issue:

Failed to retrieve schema.<error><error><incident><connection-result>failed-authentication</connection-result><date>2026-11-5 12:42:53.756</date><server>domain.local:389</server><cd-error><error-code>0x31</error-code>

<error-literal>Invalid Credentials</error-literal>

</cd-error></incident></error></error>

Exception Data (Raw): System.Management.Automation.CmdletInvocationException: Failed to retrieve schema.<error><error><incident><connection-result>failed-authentication</connection-result><date>2026-11-5 12:42:53.756</date><server>domain.local:389</server><cd-error><error-code>0x31</error-code>

<error-literal>Invalid Credentials</error-literal>

</cd-error></incident></error></error> ---> Microsoft.IdentityManagement.PowerShell.ObjectModel.SynchronizationConfigurationValidationException: Failed to retrieve schema.<error><error><incident><connection-result>failed-authentication</connection-result><date>2026-11-5 12:42:53.756</date><server>domain.local:389</server><cd-error><error-code>0x31</error-code>

<error-literal>Invalid Credentials</error-literal>

</cd-error></incident></error></error>

I have already performed the following troubleshooting steps:

Tried using different accounts with Domain Admin and Enterprise Admin privileges, but the issue persists.

Verified DNS resolution, network connectivity, and LDAP connectivity. Everything appears to be working correctly.

Temporarily disabled the EDR solution to rule out any interference, but the issue remains.

Despite verifying the account permissions and connectivity, I am still unable to complete the installation.

Any suggestions on additional troubleshooting steps or components that need to be cleaned up before reinstalling would be appreciated.

Thank you!

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Answer accepted by question author
Sreejith Reghunathan Pillai 110 Reputation points MVP
2026-11-08T21:08:33.79+00:00

Hi @PRADEEP KOCHUVEETTIL MADHAVAN

We faced a similar issue at one of our customer sites while reinstalling Microsoft Entra Connect Sync. The installation kept failing with an authentication error during AD connection, but when we tried the same configuration on a new server within the same LAN, it worked without any issues.

After some troubleshooting, we found something interesting. The customer's domain was xyz.local, and they were always entering the credentials in the format xyz\username. However, one time when we tried xyz.local\username, the authentication worked.

The funny part is that on the new server, xyz\username worked perfectly fine.

I would suggest trying the credentials using the full domain DNS name (domain.local\username) instead of the short domain name and checking whether that resolves the issue.

Also check this on that affected server and see the results
nltest /dsgetdc:xyz

nltest /dsgetdc:xyz.local

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-11-06T05:17:02.74+00:00

    At Connect your directories, select Create new account when supplying Enterprise Admin credentials; if selecting Use existing account, supply a dedicated non-administrative AD DS connector account instead, because Domain Admin and Enterprise Admin accounts are rejected for that option.

    Correct the AD DS account selection

    The 0x31 / Invalid Credentials message is occurring during the LDAP bind used to retrieve the AD schema. It is separate from the earlier ABA error.

    1. Restart the installation and choose Customize.
    2. At Connect your directories, add the forest using its AD DNS name.
    3. Choose one supported account path:
      • Create new account: enter an Enterprise Admin as DOMAIN\username or domain.local\username. The credentials are used to create the dedicated AD DS connector account.
      • Use existing account: enter a pre-created normal domain user, not a Domain Admin or Enterprise Admin. Without optional features, default Domain User read permissions are sufficient; optional features can require additional delegated rights.
    4. Complete the installation in staging mode so the DR server does not export changes while the production server remains active.

    Microsoft Entra Connect explicitly disallows an Enterprise Admin or Domain Admin as the ongoing AD DS connector account under Use existing account. Those credentials are valid only under Create new account for creating the connector identity.^1^ The installation and connector accounts are distinct, and their required permissions depend on the selected installation path and features.^2^

    Use an explicit username format rather than an unqualified name, for example:

    Create new account:
CONTOSO\EntraConnectInstaller

Use existing account:
CONTOSO\svc_EntraConnect_DR

    Do not reuse the production server’s connector identity for the DR server.

    Prove whether AD DS is rejecting the bind

    If the correctly selected account path still returns 0x31, test the exact account from the DR server with LDP.exe:

    1. Run ldp.exe.
    2. Select Connection → Connect.
    3. Enter the writable domain controller’s FQDN and port 389.
    4. Select Connection → Bind.
    5. Use the same qualified username and password entered in the wizard.
    6. Check the result:
      • Bind succeeds: inspect the Entra Connect trace described below, because the credentials themselves work.
      • Invalid credentials: investigate the account directly—locked, disabled, expired, required password change, authentication restrictions, or an incorrect username format.
      • Strong Authentication Required: the DC is rejecting that bind method because of LDAP-signing policy; this is different from invalid credentials.^3^

    Use a writable DC; Microsoft Entra Connect does not support using an RODC for this operation.^4^

    Check for stale installer state only if the trace indicates it

    Deleting files from Program Files or ProgramData does not remove Windows Installer registration. However, stale MSI state normally produces package/service/registry installation failures, not an LDAP 0x31 response. Check it only if the LDAP bind succeeds:

    1. Start the Entra Connect wizard and wait for its first page.
    2. Open the newest trace file under: 
         %ProgramData%\AADConnect\
    3. Search for: 
         GetInstalledPackagesByUpgradeCode
   stale product code
   unrecognized error (1608)
   WIX_UPGRADE_DETECTED
   ADSync service was not found
    4. If none appears, do not perform further MSI cleanup.
    5. If a stale product-code GUID is explicitly reported, use the Microsoft procedure to remove that exact product code with MSIEXEC, restart, and inspect a new trace. Do not substitute a GUID from an example or manually delete registry keys; Microsoft does not support direct registry editing for this repair.^5^

    Treat the earlier ABA error separately

    Version [IP Address] is a supported hotfix release, so installing an earlier version is not indicated.^6^

    After the AD DS stage succeeds, ensure the production and DR Connect servers receive unique Microsoft Entra connector accounts, machine identifiers, application registrations, and certificates. ABA does not support two Connect servers sharing the same application identity; that can break authentication when either server rotates its certificate. Configure the DR installation independently rather than cloning the production server or reusing its connector account.^7^

    References

    1. Custom installation of Microsoft Entra Connect
    2. Microsoft Entra Connect: Accounts and permissions
    3. Configure LDAP signing by using Group Policy for Active Directory Domain Services
    4. Prerequisites for Microsoft Entra Connect
    5. Troubleshoot Microsoft Entra Connect upgrade issues
    6. Microsoft Entra Connect: Version release history
    7. Troubleshoot Microsoft Entra Connect Sync application-based ...
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.