ODMAD: Unable to install DirSync Agent (4381403)

ODMAD: Unable to install DirSync Agent

When attempting to install or register the Quest On Demand Migration (ODM) Directory Sync Agent, the following error appears:

Registration failed. Please verify your computer can route to the endpoint and verify you entered the correct registration key.

Event Viewer may log an error:

System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream

 

This issue occurs when the agent cannot successfully negotiate a secure HTTPS/TLS connection with the ODM backend. Common causes include:

 

1. TLS 1.2 disabled or unsupported on the server.
2. Firewall, proxy, or SSL inspection blocking or terminating the HTTPS connection.
3. Incorrect or incomplete registration endpoint URL or registration key.
4. Antivirus or endpoint protection interfering with outbound TLS traffic.
5. Disabled or missing required SSL/TLS ciphers.
6. Network restrictions preventing outbound access to the required ODM endpoints over port 443.

1. Ensure TLS 1.2 is enabled - Directory Sync Agent requires TLS 1.2 for all outbound communication (HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\)
2. Verify no proxy or SSL inspection  (DPI, Deep Packet Inspection) is intercepting HTTPS -On TCP 443 outbound only. SSL inspection, TLS termination, or content filtering must be disabled for these domains.
3. Verify registration URL and key.
4. Temporarily disable antivirus/endpoint protection. Because some endpoint security products intercept TLS traffic or block unsigned installers.
5. Ensure required SSL/TLS ciphers are enabled (delete older SSL/TLS ciphers). 
6. Confirm network access to required ports and endpoints. Agent requires outbound port 443 to the Directory Sync SaaS service, and the following ports internally to domain controllers:

• 88, 135, 137–139, 389 (UDP), 445, 1027, 3268, 49152–65535
• 636, 3269 if LDAPS is enabled
• Ensure DC FQDNs are resolvable and reachable.

How to enable LDAP over SSL with a third-party certification authority? Please refer to https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/enable-ldap-over-ssl-3rd-certification-authority