Troubleshooting Sync Server Errors For Brunswick

Troubleshooting sync server errors for Brunswick can be approached in a number of ways, depending on the specific error message and the software being used.

Microsoft Entra Connect

If you are using Microsoft Entra Connect, you can refer to the Microsoft Entra Connect: Troubleshoot errors during synchronization guide. This guide covers a range of different error types, including data mismatch errors, attribute value issues, data validation failures, and access violations.

Microsoft Azure

If you are using Microsoft Azure, you can refer to the Troubleshoot Azure File Sync sync health and errors guide. This guide covers common sync issues and provides troubleshooting steps.

Microsoft Exchange Server

If you are using Microsoft Exchange Server, you can refer to the Troubleshoot ActiveSync with Exchange Server guide. This guide provides a comprehensive set of troubleshooting steps, including checking Active Directory permissions, modifying ActiveSync mailbox policies, and analysing ActiveSync mailbox logs.

Windows Server Update Services (WSUS)

If you are using Windows Server Update Services (WSUS), you may be experiencing issues due to the recent changes in WSUS endpoints. The Troubleshoot WSUS synchronization and import issues guide provides steps to identify and resolve these issues.

Microsoft Active Directory Sync Tool

If you are using the Microsoft Active Directory Sync Tool, you can refer to the How to troubleshoot Azure Active Directory Sync tool installation and Configuration Wizard errors guide. This guide covers system requirements, domain connectivity checks, and common installation problems.

Check if the agent is running locally, in the portal, and marked as healthy

When troubleshooting agent problems, you should verify that the agent was installed correctly and that it communicates with Microsoft Entra ID. Here are some steps to check if the agent is running locally, in the portal, and marked as healthy:

Microsoft Entra Admin Center Agent Verification

• Sign in to the Microsoft Entra admin center as at least a Hybrid Administrator.
• Browse to Identity > Hybrid management > Microsoft Entra Connect > Cloud sync.
• Verify that the agent in question is there. If all is well, you will see the active (green) status for the agent.

Verify the Required Open Ports

Make sure that the Microsoft Entra provisioning agent can communicate successfully with Azure datacenters. If there's a firewall in the path, ensure that the following ports for outbound traffic are open:

• Ports for downloading certificate revocation lists (CRLs) while validating the TLS/SSL certificate.
• Ports for handling all outbound communication with the Application Proxy service.
• If your firewall enforces traffic according to originating users, also open ports 80 and 443 for traffic from Windows services that run as a network service.

Allow Access to URLs

Allow access to the following URLs:

• \.msappproxy.net
• \.servicebus.windows.net
• Crl3.digicert.com
• Crl4.digicert.com
• Ocsp.digicert.com
• Crl.microsoft.com
• Oneocsp.microsoft.com
• Ocsp.msocsp.com
• Login.windows.net
• Secure.aadcdn.microsoftonline-p.com
• \.microsoftonline.com
• \.microsoftonline-p.com
• \.msauth.net
• \.msauthimages.net
• \.msecnd.net
• \.msftauth.net
• \.msftauthimages.net
• \.phonefactor.net
• Enterpriseregistration.windows.net
• Management.azure.com
• Policykeyservice.dc.ad.msft.net
• Ctldl.windowsupdate.com
• Www.microsoft.com/pkiops
• Ctldl.windowsupdate.com

Verify that the Agent is Running

• On the server with the agent installed, open Services by going to Start > Run > Services.msc.
• Under Services, make sure Microsoft Entra Connect Agent Updater and Microsoft Entra Provisioning Agent are there and confirm that their status is Running.

Common Agent Installation Problems

If you encounter problems with the agent installation, such as the agent failing to start, timing out, or encountering security errors, there are troubleshooting steps provided by Microsoft. These steps include checking group policies, configuring outbound proxies, and adjusting PowerShell execution policies.

Additional Troubleshooting Tips

• Verify domain connectivity by using the nltest command-line tool.
• Check the computer's site membership.
• Ensure that the local Active Directory domain controllers can be accessed from the server running the agent.
• Check that the local computer can access the internet and reach the Microsoft Entra authentication system.

Verify that the Microsoft Entra provisioning agent can communicate with Azure datacenters

To verify that the Microsoft Entra provisioning agent can communicate with Azure datacenters, you must first sign in to the Microsoft Entra admin center as a Hybrid Administrator. Then, browse to Identity > Hybrid management > Microsoft Entra Connect > Cloud sync. Here, you should see a list of all the agents you've installed, with their respective statuses. Confirm that the agent in question is listed here with an active (green) status.

Next, you need to verify that the required ports are open for communication. If there is a firewall in the path, ensure that the following ports for outbound traffic are open:

• Ports for downloading certificate revocation lists (CRLs) while validating the TLS/SSL certificate.
• Ports for handling all outbound communication with the Application Proxy service.
• If your firewall enforces traffic based on originating users, open ports 80 and 443 for traffic from Windows services running as a network service.

Additionally, you need to allow access to specific URLs for the connector to communicate with the Application Proxy cloud service and verify certificates. These URLs include:

• Msappproxy.net
• Servicebus.windows.net
• Crl3.digicert.com
• Crl4.digicert.com
• Ocsp.digicert.com
• Crl.microsoft.com
• Oneocsp.microsoft.com
• Ocsp.msocsp.com
• Login.windows.net
• Secure.aadcdn.microsoftonline-p.com
• Microsoftonline.com
• Microsoftonline-p.com
• Msauth.net
• Msauthimages.net
• Msecnd.net
• Msftauth.net
• Msftauthimages.net
• Phonefactor.net
• Enterpriseregistration.windows.net
• Management.azure.com
• Policykeyservice.dc.ad.msft.net
• Ctldl.windowsupdate.com
• Www.microsoft.com/pkiops

If your firewall or proxy allows configuring access rules based on domain suffixes, you can allow connections to the URLs mentioned above. Otherwise, you will need to allow access to the Azure IP ranges and service tags for the public cloud. These IP ranges are updated weekly.

Check if the Azure Active Directory Sync tool can be installed on a computer

To check if the Azure Active Directory Sync tool can be installed on a computer, the following conditions must be met:

• Windows PowerShell 1.0 is installed on the computer.
• The user is logged on to the computer as a member of the local Administrators group.
• The computer has a 64-bit processor.
• The computer is running one of the following operating systems: Windows Server 2003 x64 with Service Pack 2 (SP2) or later, or an x64-based version of Windows Server 2008.
• The computer is not a domain controller.
• The computer is joined to an Active Directory domain and is located in the forest that you want to sync with Microsoft Entra ID.
• The Microsoft .NET Framework 3.5 or later is installed on the computer.

Additionally, the user who logs on to the computer on which the Directory Sync tool is installed must be a member of the local Microsoft Identity Integration Server (MIIS) Admins group. When running the Directory Sync tool Configuration Wizard, the user must provide enterprise admin credentials for the on-premises Active Directory schema and global admin credentials for the Microsoft cloud service.

Check if the Exchange ActiveSync device requests are reaching their destination

When troubleshooting sync server errors, it is important to check if Exchange ActiveSync device requests are reaching their destination. This can be done by routing the device through an HTTP proxy and reviewing the data. Here are the steps to do this:

• Download and install Fiddler on a workstation.
• Download EAS Inspector for Fiddler.
• Extract the EAS Inspector file into the specified folder.
• Launch the Fiddler application.
• Go to the Tools menu and select Fiddler Options.
• Go to the HTTPS tab and select "Decrypt HTTPS traffic". Select "Yes" for all prompts..
• Go to the Connections tab and select "Allow remote computers to connect". Select "OK" for any prompt.
• Select "OK" and close the Fiddler application.
• Configure the ActiveSync device to use this workstation as a proxy server. This is typically done under the WiFi settings for the device.
• Launch the Fiddler application again.
• Attempt to send one or more messages from the ActiveSync client.
• Go to the File menu and select "Capture Traffic" to stop the trace.

Now, the data has been collected and the next step is to begin troubleshooting. The first step is to look at the mailbox log and check if the item was captured. Here are the steps to do this:

• Open the Exchange Management Shell.
• Run the following cmdlet to retrieve the mailbox log for a user: "Get-ActiveSyncDeviceStatistics -Mailbox user -GetMailboxLog:$True -NotificationEmailAddresses [email protected]".
• This will send the ActiveSync mailbox log to the specified email address for analysis.
• Download MailboxLogParser and extract the files.
• Launch the utility by opening MailboxLogParser.exe.
• Select "Import Mailbox Logs to Grid" to open the mailbox log.
• Enter "SendMail" under "Search raw log data for strings" and select "Search".
• Do you see the "SendMail" command in the log? If yes, proceed to check the SendMail status code. If no, proceed to analyse the Fiddler trace.

These steps will help identify and troubleshoot sync server errors related to ActiveSync device requests not reaching their destination.

Check if the WSUS server is using the correct synchronization endpoint

To check if the WSUS server is using the correct synchronization endpoint, you can follow these steps:

• Open an elevated PowerShell Command Prompt window on the WSUS server.
• Run the following PowerShell script to find the current synchronization endpoint:

$server = Get-WsusServer

$config = $server.GetConfiguration()

Check current settings before you change them

$config.MUUrl

• Verify that the WSUS server is configured to use the correct endpoint. As of July 2020, most WSUS servers should be configured to use the https://sws.update.microsoft.com endpoint, which only accepts Transport Layer Security (TLS) 1.2 connections.
• If the WSUS server is using an old endpoint such as https://sws1.update.microsoft.com or https://fe2.update.microsoft.com, you may need to change it to the new endpoint by following the steps provided in the troubleshooting guide.

By checking and verifying the synchronization endpoint, you can ensure that the WSUS server is using the correct endpoint for metadata synchronization.

Frequently asked questions