When a Push/Pull migration is started for an existing profile, SIDHistory is not added to all newly created objects during the initial migration attempt.
Subsequent retries show incremental progress, with additional SID History migration operations succeeding while some continue to fail. Repeating the same migration multiple times eventually results in all SIDHistory entries being migrated successfully.
This behavior suggests that there is no underlying security or permissions issue preventing SID History migration.
An example of SID History migration error seen in the sync logs:
Error adding SIDs during SIDHistory migration for 'CN=####' (SQL ID: ####). The remote procedure call failed and did not execute.
As part of the investigation, the following components were reviewed without identifying any issues related to the problem:
The investigation determined that the environment is highly customized, particularly regarding its RPC dynamic port configuration.
The applied policy restricted the RPC Dynamic Port Range to only a small range of available ports. See screenshot below. During testing, netstat output collected while the synchronization process was running showed that required connections could not be established consistently, indicating that the configured port range was insufficient to support the necessary RPC traffic.
For comparison, the default Windows RPC dynamic port range provides 16,384 available ports, whereas the customer's environment was configured to allow only a small range of available ports. This reduction in the available port range can lead to intermittent connection failures and cause SID History migration operations to fail unpredictably.
As a result, some SIDHistory migration operations succeed while others fail during the same migration run. Repeated migration attempts may eventually complete successfully as ports become available, which explains the intermittent nature of the issue.
Increase the RPC dynamic port range to the default Windows configuration, or to the values recommended in the product documentation, to ensure sufficient RPC ports are available for SID History migration.
For additional guidance, see KB 4372625: Syncing SIDHistory fails due to RPC error - The remote procedure call failed and did not execute.
Additional Note:
The RPC port range shown in the screenshot above refers to the RPC Static Pool Definition policy (HKLM\SOFTWARE\Microsoft\RPC\Internet), which controls the listening ports assigned to RPC services (e.g., NTDS, Spooler) by the RPC endpoint mapper when a service does not already use a fixed port. This is a destination-side setting. It governs the ports a client connects to.
The Windows dynamic (ephemeral) port range is a separate mechanism which governs the source ports used by the operating system for outbound TCP/UDP connections, and is configured independently via netsh command:
Example:
netsh int ipv4 show dynamicport tcp
netsh int ipv6 show dynamicport tcp
If failures persist after checking the Group Policy Objects (GPO) setting, verify the ephemeral range as well. If it's reduced from the Windows default (49152–65535 / 16,384 ports), it can also cause the intermittent SID History migration failures described above.
