AD Connect Password Hash Synchronization on sub domains

[TJ-Diggers]

I have a central trust domain which is my forest root and then each school is a subdomain.

AD connect sits on my central trust domain and syncs to our single Office 365 tenant.

The issue I now have is password sync from on-prem to AAD is not working for the subdomain. it syncs the forest domain fine.

I have run the Password Hash Troubleshooter and got the error below. I can see the subdomain is not running buy not sure how to switch it on. Any ideas? Under AD Connect Password sync is on but can't see any options for individual domains.

 

---

AD Connector - Trust.Edu

 

Password Hash Synchronization is enabled

Latest Password Hash Synchronization heartbeat is detected at: 07/31/2021 10:44:06 UTC

 

Directory Partitions:

==================

 

Directory Partition - Trust.Edu

Last successful attempt to synchronize passwords from this directory partition started at: 7/31/2021 10:58:06 AM UTC and ended at: 7/31/2021 10:58:06 AM UTC

Only Use Preferred Domain Controllers: False

Checking connectivity to the domain...

Domain "Trust.Edu" is reachable

 

Directory Partition - SchoolA.Trust.Edu

Password Hash Synchronization agent has never attempted to synchronize passwords from this directory partition.

Only Use Preferred Domain Controllers: False

Checking connectivity to the domain...

Domain "SchoolA.Trust.Edu" is reachable

 

[Steve21]

Is that just the standard password sync diagnostic you ran? If so what happens if you run the in depth version:

 

Invoke-ADSyncDiagnostics -PasswordSync -ADConnectorName "InsertConnectorName" -DistinguishedName "InsertDNName"

 

Steve

[TJ-Diggers]

Is that just the standard password sync diagnostic you ran? If so what happens if you run the in depth version:

 

Invoke-ADSyncDiagnostics -PasswordSync -ADConnectorName "InsertConnectorName" -DistinguishedName "InsertDNName"

 

Steve

 

Same result

[Steve21]

I take it you had both domains setup when you enabled password sync? It won't work retrospectively if you add new subs in.

 

Re-run through the AADC config and disable password hash, then re-run through and enable it again to see if it'll kick the second one into action. It won't lose anything on the main domain as long as it's enabled within a sync.

 

Steve

[TJ-Diggers]

I take it you had both domains setup when you enabled password sync? It won't work retrospectively if you add new subs in.

 

Re-run through the AADC config and disable password hash, then re-run through and enable it again to see if it'll kick the second one into action. It won't lose anything on the main domain as long as it's enabled within a sync.

 

Steve

 

No… the sub domain as added after initial setup.

 

Just re-run the setup and now all working.

 

Thanks!

[marcinham]

I have a strange issue with the hash password sync.

we have few subdomains, some of them are working fine, but few not, all users' password from one subdomain are not synced with AAD. the troubleshoot tool of Azure connector showes all is fine, no errors.. however when an user changes its password, its stay only in AD.. is there is any other way to check what is happening here?