-
Titre
DirSync: Discover Logs Indicate following: The supplied credential is invalid -
Description
The process is unable to read our other subdomains:
In the Discover Logs you will see the following error:
System.DirectoryServices.Protocols.LdapException: The supplied credential is invalid.at System.DirectoryServices.Protocols.LdapConnection.BindHelper(NetworkCredential newCredential, Boolean needSetCredential)at CDS.Model.DomainController.Connect(NetworkCredential credentials, Int32 port)at CDS.Model.ActiveDirectory.GetDomainSid(DomainController dc, String rootDn, String userName, String password)at CDS.Model.ActiveDirectory.DiscoverDCs(DomainController gcs, String configNamingContext) -
Cause
Cause 1
The domains may be configured to only accept the legacy NETBIOS user logon format (DOMAIN\User) rather than UserPrincipalName format (user@domain.local).
Cause 2
NTLM authentication is disabled. -
Résolution
Resolution 1
Navigate to the ODM Directory Sync Agent server.
Open elevated regedit session.
Navigate to:HKEY_LOCAL_MACHINE\SOFTWARE\Binary Tree\P365Agent\UserName key
or
HKEY_LOCAL_MACHINE\SOFTWARE\Quest\On Demand Migration For Active Directory\ODMAD_DS\UserName
Double click on UserName key:
Change the format from UPN to "Domain\ServiceAccount" format
Navigate to Services
Restart the On Demand Directory Sync Agent ServiceNavigate to the On Demand Migration UI dashboard and re-run the Discover process. You should now note the error message is no longer present.
Additionally the all domains (to include sub-domains) are read as expected.
Resolution 2
Enable NTLM authentication. If NTLM was disabled via Group Policy, it will need to be allowed in Group Policy. Then it will likely need to be separately enabled using the Local Security Policy on the Domain Controllers.