Entra connect sync upgrade in place issues

Question

Entra connect sync upgrade in place issues

Jason Gunter 0

Good afternoon,

I recently updated one of two servers to the Entra Connect Sync version 2.6.84 from 2.4.21.0. I followed the steps to upgrade our staging server first, then change the staging to active and make the active server the new staging. I haven't upgraded the second server yet as we appear to have run into issues on the first server.

As you can see in the screenshot we have an active error on ITSERVER187.
User's image

The active error is the following:

User's image

I have since swapped the Active and Staging again back to what it was thinking that may have been part the issue. The original active server is still running Entra Connect Sync 2.4.21. We haven't updated it, thinking maybe there is an issue with the update.

I see the sync is running on the staging server (ITSERVER187) but there are errors and these errors weren't here until after the update. The stopped-server-down appears to happen all the time on this staging server and it didn't just start happening after the update.
User's image

Just looking for some guidance on what to try here and has anyone experienced this while upgrading to this version?

Thanks

Jason

0 comments

1 answer

Your answer

Answer 1

Based on the reported sequence, the safest next steps are:

Keep only one active sync server at a time. Before promoting a staging server, the current active server must be switched to staging mode first. Microsoft states there should only be one active Microsoft Entra Connect Sync server at any time.
On the upgraded server, verify it is actually in staging mode if it is intended to remain standby:
```
   Import-Module ADSync
   Get-ADSyncScheduler
```
Confirm StagingModeEnabled is True when the server is supposed to be staging.
If planning another failover test, follow the documented failover prerequisites before switching roles:
- Ensure the staging server has synchronized with Microsoft Entra ID recently.
- If synchronization rules or sync scope changed, run an initial sync cycle.
- Verify pending exports and confirm there are no significant unexpected updates.
- Confirm accidental delete protection is configured.
- Check that the Microsoft Entra Connect Health agent is updated.
Since the error shown is “Import from Microsoft Entra ID failed” and the Sync Service Manager shows completed-sync-errors, clean up the synchronization step errors first. Microsoft documents that Events 6311 and 6401 are logged after a synchronization step error, and the fix is to resolve the underlying synchronization step errors.
Because the issue appeared after upgrading the staging server, validate that both servers still have matching configuration before attempting to promote the upgraded server again. Microsoft guidance for swing migration says that if custom configuration exists, the same changes must be applied to the staging server, and the staging server should complete full import/full synchronization and then be verified for unexpected changes before switching active roles.
If custom sync rules were changed on the old active server and not moved to the upgraded server, export and apply the same custom synchronization rules/settings to the staging server. The documented guidance specifically calls out keeping the same forests, domain/OU filtering, and optional features such as password sync and password writeback aligned.
Do not edit the Windows registry to troubleshoot the upgrade. Microsoft explicitly warns that registry editing is unsupported for Microsoft Entra Connect upgrade troubleshooting.
Do not upgrade the second server yet. First stabilize the upgraded server by:
- confirming staging mode state,
- checking for sync step errors,
- validating configuration parity,
- running full import/full synchronization if configuration was adjusted,
- verifying pending exports before any new role switch.
If password writeback is enabled, be especially careful during role changes. Microsoft warns that switching a server to active while another Entra Connect server is still active can disrupt password writeback service bus communication.

The stopped-server-down entry on a staging server is not enough by itself to prove the upgrade failed. The more important signal is the Microsoft Entra ID import failure and the sync step errors on the upgraded server. Focus troubleshooting there before another cutover.