Azure Active Directory Sync errors

[Jawloms]

I deleted some groups out of AD a few days ago (more than six) and since then I get an email about once a day telling me there were sync errors. In the past when I've had sync errors I get an email every half an hour as that is the frequency of it syncing so I found it a bit odd it's only once a day. Anyway, I looked at it today and am more confused. I've attached a shot of the errors, which are all blank, and then a shot of what I see when I click on one. Any ideas anyone please?

 

Thank you

 

Stuart

 

Edited January 27, 2022 by Jawloms

[Steve21]

Two things to check, do you have any licenses assigned to the group via azure? As it wouldn’t always delete the group until the license is removed ifndynamic etc

 

Also, on the server do you have the deleted groups moved somewhere that isn’t set to sync in the OU profiles of the sync? As this can upset it sometimes

 

Steve

[Jawloms]

Two things to check, do you have any licenses assigned to the group via azure? As it wouldn’t always delete the group until the license is removed ifndynamic etc

 

Also, on the server do you have the deleted groups moved somewhere that isn’t set to sync in the OU profiles of the sync? As this can upset it sometimes

 

Steve

 

Thanks for the reply. I've never assigned licences to groups, always to individuals, and the groups don't go to anywhere else.

[chaplic]

Does the MIM Admin console on AADC give any clues? find the syncronisation service manager and run as admin. This can sometimes give better error messages

[Jawloms]

That looks useful, but I've never heard of or used MIM. Where would I get it?

[HPlum78]

AAD connect is essentially MIM under the hood the sync tools are installed on your aad connect server.

[chaplic]

"C:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe" is where it is by default

[Jawloms]

I don't have a "UIShell" folder.

[chaplic]

have a search for miisclient.exe

[Jawloms]

Found it!

 

(Now that I am looking at the correct server )

[HPlum78]

At least you called yourself out... what's the sync service say? Or have you managed to sort it now?

[Jawloms]

Looks like @Steve21 was right. The error in Synchronization Service Manager says "Unable to delete the group because there is a product license assigned to the group. To delete this group, remove any product licenses first.". It doesn't tell me which group or what license though.......

[Steve21]

Looks like @Steve21 was right. The error in Synchronization Service Manager says "Unable to delete the group because there is a product license assigned to the group. To delete this group, remove any product licenses first.". It doesn't tell me which group or what license though.......

 

Well if it's only a few groups you deleted easiest would be just search in AzureAD and see which still exists

 

If it's a lot of groups then be lazy and do it like:

 

Connect-AzureAD
Get-AzureADObjectByObjectId -ObjectIds 0a86d19b-b386-409a-9872-30033c21d4af

etc

 

Steve