ODM DirSync - Discovery: Error connecting to endpoint: The supplied credential is invalid. (4366459)

The discovery is failing with the following error:

at CDS.Model.Agent.ExecuteJobs(CancellationToken cancellationToken)" x/x/2022 15:06 EndpointID FQDN-Endpoint: Discovery: Using the default global catalog server configured during agent install: server.domain1.com, Domain=domain1.com x/x/2022 15:18 768214235 EndpointID FQDN-Endpoint: Error connecting to endpoint: The supplied credential is invalid. "System.DirectoryServices.Protocols.LdapException: The supplied credential is invalid. at System.DirectoryServices.Protocols.LdapConnection.BindHelper(NetworkCredential newCredential, Boolean needSetCredential) at CDS.Model.DomainController.Connect(NetworkCredential credentials, Int32 port) at CDS.Model.ActiveDirectory.Connect() at CDS.Model.Agent.ExecuteJobs(CancellationToken cancellationToken)

The above behavior typically occurs when:

1. The DC in scope was upgraded from earlier version of OS such as 2003/2008/2012. 
2. Service account password has expired/changed or it contains special characters.
3. LDAPS is enabled in the DC/s, but it not enabled in ODM under the environment settings.
4. NTLM authentication is disabled. 
5. The LmcompatibilityLevel is not matching between DC and the Agent server.  The NTLM authentication level configured on the agent server and DC must match. If the NTLM versions do not match, the domain controller may reject the authentication attempt, resulting in the error.

Resolution 1:

• Change the account information in the agent to use the <domain>\<serviceaccount> format instead of the UserPrincipalname

Resolution 2:

• Update or change the service account password, please see KB 4370998

Resolution 3:

1. Check if secure LDAP is enabled in the DC.  You can do this by running the following PS command from the agent server:
   • Test-NetConnection dcname.domain.com -Port 636
   • If it is enabled then make sure this is also enabled in the environment setting in ODM, example:

Resolution 4:

• Enable NTLM authentication.
  • If NTLM was disabled via Group Policy, it will need to be allowed via Group Policy. It will likely need to be separately enabled using the Local Security Policy on the Domain Controllers.

Resolution 5:

• Verify the LAN Manager authentication level (NTLM) setting on the DirSync agent server and on the Domain Controller.
• Ensure that both systems are configured to use compatible NTLM versions.
• Review and align the configuration based on Microsoft’s official documentation:
  • https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level
• The NTLM authentication level is controlled by the following registry key:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel

Note: If you are using Enterprise access model, please see KB 4328932.