Return
-
Title
Preinstalled mode password sync error "Cannot install AePAgent" -
Description
Password synchronization in Migration Manager has been configured as described in "Using Preinstalled Service Feature" chapter of Granular Account Permissions documentation.
However whenever users are synchronized from the source AD to the target AD, the dsa.log contains errors similar to the following: Error 0xe1000051. Cannot compare password hashes, source user: "Test1", target user: "Test1" Error 0x80070005. Cannot install AePAgent. Cannot identify CPU type. Access is denied. (source=AePwd.PwdInstEx.1).
The user accounts get created on the target AD, but in "disabled" state. There are no firewalls enabled between source and target DCs and no AV products installed on them either.
-
Cause
If the error message contains "Cannot install AePAgent" line, it means that DSA is trying to install new password agent on the DC instead of using the preinstalled one, so the EnablePreinstalledMode.ps1 script did not run on the Directory Synchronization Agent server or was not ran correctly. When EnablePreinstalledMode.ps1 runs from 64-bit Powershell, it will create the Preinstalled registry key in HKLM:\SOFTWARE\Aelita\Migration Tools\CurrentVersion\Password Agent and on 64-bit machines it should be located under HKLM\Software\Wow6432Node\ instead. -
Resolution
Confirm that EnablePreinstalledMode.ps1 script is being executed on the correct DSA server and this is done from 32-bit Powershell exactly as described in the documentation quoted below. Also note that the other AllowAccess.ps1 script on the domain controllers should be executed from the 64-bit Powershell if the DC is 64-bit.To configure the Directory Synchronization Agent using the EnablePreinstalledMode.ps1 scriptCopy Switch Agent Mode folder containing preinstalled service distributive from \\QMM_host\DSASetup\ to the convenient folder.Stop all synchronization jobs of the Directory Synchronization Agent that may be in progress on Quest Migration Manager console.Open 32-bit (x86) version of the PowerShell prompt on the computer where Directory Synchronization Agent is hosted and execute the following commands:cd "<full path to the folder used for preinstalled service distributive on step 1 above>".\EnablePreinstalledMode.ps1Restart the synchronization jobs of the Directory Synchronization Agent that have been stopped on Quest Migration Manager Console on the step 2. -
Additional Information
The same error may happen if the service account has been removed from the Domain Admins group so there are insufficient permissions causing it.