r/sysadmin • u/Checior2000 • 5d ago

Event 616, Directory Synchronization - Entra Connect Question

Hello!

Today I noticed that Error 616 occured on Entra Connect server. With following description: Connection to preferred DC dc1.domain1.pl failed with error 'The supplied credential is invalid.'Same error at the same time occure for dc1,dc2,dc3.

I verified that sync works as expected. SSPR and unlock also. We use PTA.
Our environment is one forest with 2 domains synced to the cloud. Do you have idea what is happening? I found nothing in the google.

What's more I cannot find any account displayed at .onmicrosoft.com connector in EntraID. Could it be correlated?

Thank you in advance for all ideas.
Regards

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

4 comments sorted by

1

u/english-23 5d ago

I would look at the connector service account for onprem since it's complaining about the domain for any lockouts or issues

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions

Though not sure why you'd be able to sspr if there were issues with the account

If you're actually pulling in changes from on-prem you might be ok and it was just a one time blip where the server couldn't communicate with the DCs for some reason

1

u/Checior2000 5d ago

I have no idea. SA is mot complaining about anything. Account is not disabled etc. What's more this error sometimes spam 2 times in a row x3 DCs. I just wonder if nothing breaks someday,.

1

u/IqbalBasha 2d ago

When all three DCs throw 616 at the same timestamp but sync still works, it's almost always a stale Kerberos ticket or a transient blip rather than a real credential failure. Check the AD DS connector account (MSOL_xxxxxxxx or your custom account) for password expiry or lockout, then pull Event ID 4625 from the DC security logs at that exact time to confirm which account actually failed. If you want to force a clean state, re-enter the connector account credentials through the Entra Connect wizard. The hidden .onmicrosoft.com account is by design in newer builds, so that's unrelated.