How to troubleshoot Azure Active Directory Sync tool installation and Configuration Wizard errors

General troubleshooting for Directory Sync tool installation and for Configuration Wizard issues

System requirements

 The Azure Active Directory Sync tool can be installed on a computer if all the following conditions are true: 

• Windows PowerShell 1.0 is installed on the computer.
• You are logged on to the computer as a member of the local Administrators group.
• The computer has a 64-bit processor.
• The computer is running one of the following operating systems:
  • Windows Server 2003 x64 with Service Pack 2 (SP2) or a later version
  • An x64-based version of Windows Server 2008
• The computer isn't a domain controller.
• The computer is joined to an Active Directory domain and is located in the forest that you want to sync with Azure Active Directory (Azure AD). 
• The Microsoft .NET Framework 3.5 or a later version is installed on the computer.

Permissions

To start the Directory Sync tool Configuration Wizard successfully, users who log on to the computer on which the Directory Sync tool is installed must be a member of the local Microsoft Identity Integration Server (MIIS) Admins group that was added during installation of the tool.

When you run the Directory Sync tool Configuration Wizard, you must provide the following information:

• Enterprise admin credentials for the on-premises Active Directory schema
• Global admin credentials for the Microsoft cloud service

How to troubleshoot the "The computer must be joined to a domain" error message

To troubleshoot this error message, check the domain membership of the computer. To do this, follow these steps:

1. Log on to the computer.
2. Right-click My Computer, and then click Properties.
3. Click the Computer Name tab. If the computer is a domain member, the Full Computer Name resembles ComputerName>.<Domain>.<xxx>. The domain name appears next to Domain.

If the computer is a domain member and you still receive the error message, you should verify that the computer can communicate with the domain and can discover the domain controller. To do this, follow these steps:

1. Use the ipconfig command-line tool to check the Domain Name System (DNS) settings on the server.
2. Confirm that you can ping the DNS server that's listed in the network properties on the problem computer.
3. Run the nslookup command-line tool. If the DNS server is unreachable, you receive an error message. For example, you receive an error message that resembles the following:
   DNS request timed out.
   timeout was 2 seconds.
   *** Can't find server name for address 157.56.149.72: Timed out
   Default Server: UnKnown
   Address: 157.56.149.72

Sometimes, joining the computer to a workgroup and then joining the computer back to the domain may resolve this error message. If the computer can't join the domain, this indicates that the computer is experiencing an issue in contacting the domain controllers or that the Active Directory domain is rejecting the request.

Use the nltest tool

• Run the Nltest command-line tool. To do this, type the following at the command prompt:

  Nltest /dsgetdc:<FQDN of the domain> 

  
  Note The Nltest tool requires installation of the Windows Server 2003 Support Tools.
  
  If the settings are correct, you receive output that resembles the following:

  DC: \\DC.contoso.com Address: \\157.56.149.72 Dom Guid: a3bd534c-19e9-4330-81ad-a8ee34cd7298 Dom Name: contoso.com Forest Name: contoso.com Dc Site Name: Default-First-Site-Name Our Site Name: Default-First-Site-Name Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE The command completed successfully 

• Run the following command to check the computer's site membership:

  nltest /dsgetsite 

  A successful result resembles the following:

  Default-First-Site-Name
   The command completed successfully 

How to troubleshoot the "The Azure Active Directory Sync Tool is already installed" error message

In this case, the Directory Sync tool may not be installed because of a previous pending installation. During installation, the Setup package also installs software in the background. To resolve this issue, follow these steps:

1. In Control Panel, check whether Microsoft Identity Integration Server is listed in Add or Remove Programs or in Programs and Features. If it is present, you must remove it.
2. Verify that the Program Files folder contains a subfolder that's named "Microsoft Identity Integration Server." If the subfolder exists, you must rename the folder to "Microsoft Identity Integration Server_Old."
3. Run Setup again.

How to troubleshoot the "The Microsoft Online Services Sign-in Assistant service installation returned FAIL. See the event log for more detailed information." error message

You receive the following error message when you try to install the Azure Active Directory Sync tool:Additionally, the following events are logged to Event Viewer:
To resolve this issue, see the following Microsoft Knowledge Base article:

How to troubleshoot additional error messages

All directory synchronization logging is viewable in Event Viewer. To view all events that are related to directory synchronization, follow these steps:

1. Open Event Viewer.
2. Expand Windows Logs, and then expand Application.
3. In the Actions pane, click Filter Current Log.
4. In the Event sources box, select the Directory Synchronization check box.
5. Click OK.

The following table lists the error name, the error details, the error source, and the steps to help resolve the error.

Still need help? Go to Microsoft Community or the Azure Active Directory Forums website.