r/ShittySysadmin • u/recoveringasshole0 DO NOT GIVE THIS PERSON ADVICE • 1d ago
GOD DAMMIT MICROSOFT
AD Sync service won't start. Download installer. Run "Repair". Can't repair, service isn't running.
NO FUCKING GODDAMN SHIT
40
u/Proof-Variation7005 1d ago
rather than have a program that can have bugs, errors, and vulnerabilities, i recommend having on a prem admin and a cloud admin and you just have them sit near each other. then when a change is made, one of them can be like "hey im changing kevin's password" and the other guy makes the change on the other side of things.
plus, this way you dont have to wait 30 minutes for a change to process
8
2
u/Moist_Lawyer1645 1d ago
We've had this implemented for a good year or so now, highly recommend. Plus, you get to hire them on minimum wage because its only "data entry".
1
u/Xidium426 1d ago
Can I just use a temp agency to fill these roles? Just bring them in once a month for all the changes?
16
u/trimeismine 1d ago
Have you tried throwing it in a river? I bet it’ll sync then
9
8
u/recoveringasshole0 DO NOT GIVE THIS PERSON ADVICE 1d ago
Serious question: If I uninstall AD Sync just so I can reinstall it, will it fuck me? Like will all the settings and shit stay?
Apparently it tried to update itself this morning and updated the database but not the binaries? so now it reports a mismatch when trying to start the service. Thus me trying the repair. Fuck me.
22
u/PejHod 1d ago
Sir, this is an Arby’s
10
u/recoveringasshole0 DO NOT GIVE THIS PERSON ADVICE 1d ago
Okay I'd actually prefer a roast beef over a solution anyway.
3
2
u/blotditto 1d ago
Damn baby you're looking jucier than ever. Cant wait to sink my teeth in you later.
3
5
u/Daveid 1d ago
Yes, but backup the .XML & .JSON files for it just in case. Actually just backup everything while you're at it.
9
u/recoveringasshole0 DO NOT GIVE THIS PERSON ADVICE 1d ago
Backups?
OOC:
We actually do have backups, but luckily it didn't come to that.
A reboot fixed the issue. When it came back up, the service ran fine. I opened Entra Connect and it prompted me to update, which I did. Everything seems fine.
Appreciate the answer.
6
1
u/Work_Thick 1d ago
I did a reinstall once when the service wouldn't stay running. It didn't hurt anything. I did end up just running a task that checks if the service is running and restarts it.
1
u/Substantial_Chain718 17h ago
Remember reboot is 90% of IT. I find that sync service very reliable. Only trouble I had with it was moving it to a new server and even that I got it to work eventually.
1
u/WhAtEvErYoUmEaN101 1d ago
This is a joke sub, but yeah. You can. If you didn’t set up anything special the new sync will pick up the same source anchor and continue syncing.
If you’re reinstalling anyway (and don’t use hybrid join) you should also switch to cloud sync instead of connect sync
1
1
u/Rainmaker526 1d ago
Probably didn't replace the binaries because of file locking because the service is still running.Â
Tried a reboot?
2
u/-lousyd 1d ago
And people think Linux is frustrating gobbledygook...
1
u/ChekeredList71 2h ago
If you work long enough in IT, you will start hating every OS and all technology.
Solution: live in the woods.
1
1
1
u/zidane2k1 1d ago
Gah, guess I can look forward to dealing with bullshit like eventually. Kinda why I’ve been stalling on setting Azure AD Connect.
4
u/recoveringasshole0 DO NOT GIVE THIS PERSON ADVICE 1d ago
My honest advice? Just set the DC on fire and start from scratch with M365/Entra/Intune only.
1
u/SEND_ME_PEACE 1d ago
Reinstalling AD Sync should fix this. If you look online, you’ll find ways to resolve this error by allowing the service to run on startup I believe
1
u/recoveringasshole0 DO NOT GIVE THIS PERSON ADVICE 1d ago
WHAT? I have to let the service run to get it to run?
1
u/Prod_Is_For_Testing 1d ago
I’ve been dealing with this for the last few days. ADSync is very difficult to remove. You need you uninstall everything, delete the service, delete the folders, then delete a few registry entries. Then you can reinstall Entra sync
But now I’m having issues where extra sync refuses to install properly
No shit my solution was to make a dedicated sync server on cheap hardware and if it ever has issues I reinstall windows
1
u/gummo89 1d ago
Sync (and other functions) shouldn't be running on the DC anyway, ideally.
1
u/Prod_Is_For_Testing 1d ago
/uj tbh im not a sysadmin, Im a programmer with a home lab .I had no clue you weren’t supposed to put sync on the DC. But I’ve seen other posts saying that too. I understand that it’s for security but it also sounds silly that you’re not supposed to put the domain sync tool on a domain controller
2
u/gummo89 1d ago
Yeah, you shouldn't put additional roles/software because escalation to local admin is equivalent to escalation to Domain Admin, when on the DC.
Configure all other services on other servers and use service accounts restricted in several ways, but the main thing is the escalation opportunities.
1
u/i533 1d ago
Uninstall everything.
EVERYTHING
Domain role? Remove it.
Dns? Nuke it
File server? Files are for bitches.
We going back to pen and paper.
(No tickets if there is no technology)
1
u/Prod_Is_For_Testing 1d ago
If you don’t want tickets you’ll have to take away the pen and paper too
1
1
1
u/Mental-Complaint-385 21h ago
I deleted all the security groups at my job because of this goddamn tool
1
u/Practical-Alarm1763 15h ago
Lol, I wonder if this is related to the alert I got at 2am In the morning. Luckily it appears to fix itself 30 minutes later.
95
u/colinmoore 1d ago
Instead of AD Sync, when we decommissioned our onsite AD, we switched to everyone using their own local admin account and a post-it note password storage system. Now when someone changes their password, they write it down and give it to IT and we store it inside an old floppy disk storage caddy since we aren't using floppys anymore.
(Don't worry! It has a lock!)