Fix: Azure AD Connect Password Hash Sync “Password Validation Failed” (Event IDs 611, 612, 6900)
🔍 Symptoms
⚠️ What You May Experience
- Event ID 611 / 612 — Password hash synchronization failed, visible in the Application Event Log on the Azure AD Connect server
- Event ID 6900 — Password validation failed for the sync account
- Password changes made in on-premises AD are not reflected in Entra ID
- Delta sync completes successfully but skips password updates
- Errors referencing insufficient permissions or credential issues
🧠 Root Cause
Why Password Hash Sync Fails
- Incorrect or expired Azure AD Connect sync account credentials
- Missing directory replication permissions on the AD account used for PHS
- Password sync feature disabled or misconfigured
- Connector configuration corruption or account mismatch
- Improper delegation during manual permission assignment
⚠️ Important
Even if credentials are reset, missing replication rights or stale connector configurations can still block password sync. Both must be verified.
🛠️ Step-by-Step Resolution
Verify Password Hash Sync is Enabled
Confirm the PHS feature is active before investigating further. Run the following on the Azure AD Connect server.
Import-Module ADSync Get-ADSyncAADCompanyFeature | Select PasswordHashSync
✅ Expected Result
The output should show: PasswordHashSync : True
If it shows False, re-enable it via the Azure AD Connect wizard (see Step 8).
Check Sync Scheduler Status
Verify the sync scheduler is running and not suppressed, which could prevent password updates from being processed.
Get-ADSyncScheduler
✅ Verify the following
- SyncCycleEnabled : True
- No sync suppression is present in the output
Validate AD Connector Configuration
Confirm the Active Directory Connector is using the correct account with valid, non-stale credentials.
Get-ADSyncConnector
💡 What to Check
- The Active Directory Connector is referencing the correct service account
- No invalid or stale credentials are listed against the connector
Reset Sync Account Password
If the sync account password is suspected to be incorrect or expired, reset it in AD and update it in Azure AD Connect.
✅ GUI Method — Azure AD Connect Wizard
- Reset the password in Active Directory Users and Computers (ADUC)
- Open Azure AD Connect → Configure
- Choose Change connection credentials
- Enter the updated AD DS account password and complete the wizard
Re-Assign Required Replication Permissions
The sync account must have the correct directory replication permissions on the domain root. Missing permissions are a leading cause of Event ID 6900.
⚠️ Required Permissions on the Domain Root
- ✔ Replicate Directory Changes
- ✔ Replicate Directory Changes All
- ✔ Replicate Directory Changes In Filtered Set (if applicable)
✅ GUI Method — Active Directory Users and Computers
- Open ADUC → right-click the domain root → Delegate Control
- Add the sync account
- Assign Replicating Directory Changes permissions
Force a Delta Sync
After applying credential or permission fixes, trigger a delta sync and monitor Event Viewer for successful password sync events.
Start-ADSyncSyncCycle -PolicyType Delta
✅ Validation — Event Viewer
- Event ID 656 → Password sync successful
- Event ID 657 → Password sync failure details (if errors persist)
Restart Azure AD Connect Services
If errors persist after the delta sync, restart the ADSync service to clear any service-level issues.
Restart-Service ADSync
(Recommended) Re-run the Azure AD Connect Wizard
If manual fixes do not resolve the issue, reconfigure using the wizard. This is the Microsoft-recommended approach and ensures a supported configuration is applied.
✅ GUI Method — Azure AD Connect
- Open Azure AD Connect → Configure
- Choose Change user sign-in
- Re-enable Password Hash Sync and complete the wizard
💡 Why Re-run the Wizard?
The wizard resets connector space, re-validates permissions, and re-applies a clean configuration — catching issues that manual PowerShell fixes can miss, such as corrupt connector configurations or account mismatches.
💡 Best Practices & Recommendations
- Always use the Azure AD Connect wizard instead of manual permission changes where possible — it ensures a Microsoft-supported configuration
- Avoid using custom accounts unless required — Microsoft recommends using the default service accounts created during setup
- Set the sync service account password to never expire, or use a Managed Service Account (MSA) to prevent credential expiry issues
- Regularly monitor Event Viewer → Application log for Directory Synchronization events on the Azure AD Connect server
- After any permission change, always force a delta sync and confirm Event ID 656 before closing the incident
✅ Key Takeaway
If you’re still seeing Event ID 6900 after all manual fixes, the issue is almost always tied to a corrupt connector space or account mismatch. Re-running the Azure AD Connect configuration wizard typically resolves it cleanly by rebuilding the connector with fresh credentials and validated permissions.
📚 References & Further Reading
- 🔗 Implement Password Hash Synchronization with Azure AD Connect — Microsoft Learn
- 🔗 Azure AD Connect Sync Scheduler — Microsoft Learn