Error while trying to install Microsoft Entra Connect on my passive server at the DR site

At Connect your directories, select Create new account when supplying Enterprise Admin credentials; if selecting Use existing account, supply a dedicated non-administrative AD DS connector account instead, because Domain Admin and Enterprise Admin accounts are rejected for that option.

Correct the AD DS account selection

The 0x31 / Invalid Credentials message is occurring during the LDAP bind used to retrieve the AD schema. It is separate from the earlier ABA error.

1. Restart the installation and choose Customize.
2. At Connect your directories, add the forest using its AD DNS name.
3. Choose one supported account path:
   • Create new account: enter an Enterprise Admin as DOMAIN\username or domain.local\username. The credentials are used to create the dedicated AD DS connector account.
   • Use existing account: enter a pre-created normal domain user, not a Domain Admin or Enterprise Admin. Without optional features, default Domain User read permissions are sufficient; optional features can require additional delegated rights.
4. Complete the installation in staging mode so the DR server does not export changes while the production server remains active.

Microsoft Entra Connect explicitly disallows an Enterprise Admin or Domain Admin as the ongoing AD DS connector account under Use existing account. Those credentials are valid only under Create new account for creating the connector identity.^1^ The installation and connector accounts are distinct, and their required permissions depend on the selected installation path and features.^2^

Use an explicit username format rather than an unqualified name, for example:

Create new account:
CONTOSO\EntraConnectInstaller

Use existing account:
CONTOSO\svc_EntraConnect_DR

Do not reuse the production server’s connector identity for the DR server.

Prove whether AD DS is rejecting the bind

If the correctly selected account path still returns 0x31, test the exact account from the DR server with LDP.exe:

1. Run ldp.exe.
2. Select Connection → Connect.
3. Enter the writable domain controller’s FQDN and port 389.
4. Select Connection → Bind.
5. Use the same qualified username and password entered in the wizard.
6. Check the result:
   • Bind succeeds: inspect the Entra Connect trace described below, because the credentials themselves work.
   • Invalid credentials: investigate the account directly—locked, disabled, expired, required password change, authentication restrictions, or an incorrect username format.
   • Strong Authentication Required: the DC is rejecting that bind method because of LDAP-signing policy; this is different from invalid credentials.^3^

Use a writable DC; Microsoft Entra Connect does not support using an RODC for this operation.^4^

Check for stale installer state only if the trace indicates it

Deleting files from Program Files or ProgramData does not remove Windows Installer registration. However, stale MSI state normally produces package/service/registry installation failures, not an LDAP 0x31 response. Check it only if the LDAP bind succeeds:

1. Start the Entra Connect wizard and wait for its first page.
2. Open the newest trace file under:

      %ProgramData%\AADConnect\
   

3. Search for:

      GetInstalledPackagesByUpgradeCode
      stale product code
      unrecognized error (1608)
      WIX_UPGRADE_DETECTED
      ADSync service was not found
   

4. If none appears, do not perform further MSI cleanup.
5. If a stale product-code GUID is explicitly reported, use the Microsoft procedure to remove that exact product code with MSIEXEC, restart, and inspect a new trace. Do not substitute a GUID from an example or manually delete registry keys; Microsoft does not support direct registry editing for this repair.^5^

Treat the earlier ABA error separately

Version [IP Address] is a supported hotfix release, so installing an earlier version is not indicated.^6^

After the AD DS stage succeeds, ensure the production and DR Connect servers receive unique Microsoft Entra connector accounts, machine identifiers, application registrations, and certificates. ABA does not support two Connect servers sharing the same application identity; that can break authentication when either server rotates its certificate. Configure the DR installation independently rather than cloning the production server or reusing its connector account.^7^

References

1. Custom installation of Microsoft Entra Connect
2. Microsoft Entra Connect: Accounts and permissions
3. Configure LDAP signing by using Group Policy for Active Directory Domain Services
4. Prerequisites for Microsoft Entra Connect
5. Troubleshoot Microsoft Entra Connect upgrade issues
6. Microsoft Entra Connect: Version release history
7. Troubleshoot Microsoft Entra Connect Sync application-based ...