During the configuration process, specifically at the “Configure AAD Sync” stage, the setup fails with an authentication-related error when attempting to retrieve the Active Directory schema.

Question

During the configuration process, specifically at the “Configure AAD Sync” stage, the setup fails with an authentication-related error when attempting to retrieve the Active Directory schema.

Juliet Nabateesa 0

ExecuteADSyncConfiguration: configuration failed. Skipping export of synchronization policy. resultStatus=Failed An error occurred executing Configure AAD Sync task: Failed to retrieve schema. <connection-result>failed-authentication</connection-result> <server>jcrc.org.ug:389</server> <error-code>0x31</error-code> <error-literal>Invalid Credentials</error-literal>

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-04-28T05:37:19.6866667+00:00
Hey Juliet, it looks like your AD Connect setup is choking at the “Configure AAD Sync” step because it can’t bind to your on-prem AD (jcrc.org.ug:389) with the credentials you provided. The key error is:

Failed to retrieve schema

<error-literal>Invalid Credentials</error-literal>

Here’s what to check and fix:

Verify which account you’re using

If you chose Express settings, a virtual service account (or Azure AD–created account) is used automatically.

If you did a custom install, you manually supplied an AD DS Connector account—make sure that’s the account you’re troubleshooting.

Re-enter and test the credentials

In the Configuration Wizard, click Change Credentials for the AD DS connector, re-type the username in UPN or DOMAIN\user format, and carefully paste the password.

Ensure the account isn’t locked out or its password expired.

Grant the right AD permissions

The AD DS Connector account must have at minimum: • Replicate Directory Changes • Replicate Directory Changes All

These should be set on the domain root (not just a sub-OU).

If you’re enabling other features (password writeback, Exchange hybrid, etc.), follow the tables in the docs to add those specific permissions.

Confirm network connectivity to port 389/636

From the server hosting AD Connect, try ldp.exe or telnet jcrc.org.ug 389 to make sure you can reach your DC on LDAP.

Rerun the sync wizard

Once the creds and permissions are sorted, restart the Microsoft Entra Connect Configuration Wizard. The “Configure AAD Sync” task should now be able to retrieve the schema and proceed.

If you’re still stuck, can you share:

Whether this was an Express or Custom install

The exact account name/format you provided to the wizard

If the account’s password was recently changed or has any custom complexity policies

Hope that helps—let me know what you find!

Reference list

Permission issues with Microsoft Entra Connect Sync: https://docs.microsoft.com/azure/active-directory/hybrid/reference-connect-accounts-permissions

Configure AD DS Connector account permissions: https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-configure-ad-ds-connector-account

Troubleshoot installation issues with Microsoft Entra Connect Sync: https://docs.microsoft.com/troubleshoot/azure/active-directory/installation-issues

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-04-29T02:09:07.0533333+00:00

Juliet Nabateesa

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-04-29T02:09:07.0533333+00:00

Juliet Nabateesa

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

The error indicates that the account used by the Azure AD/Entra ID Sync configuration wizard cannot authenticate to the on‑premises Active Directory (LDAP error 0x31 – invalid credentials) when trying to read the schema.

Use these checks and fixes, in order:

Verify the AD credentials being entered

Ensure the username and password are correct (no typos, expired password, or locked account).
Confirm that the account has Enterprise Admin permissions in the forest that the sync server is joined to.
To verify Enterprise Admin membership:
1. On a domain controller (or a machine with RSAT), open Active Directory Users and Computers (dsa.msc).
2. Right‑click the domain, select Find.
3. In Name, type enterprise admins, select Find Now.
4. Open Enterprise Admins, go to Members, and confirm the sync account is listed. If not, add it or use an account that is a member.

Confirm the sync server can authenticate to AD

The sync server must be joined to the same forest whose schema is being read and must be able to contact domain controllers.
Check that:
- The server is domain‑joined to the correct AD forest.
- Network connectivity to domain controllers (LDAP/389, Kerberos, DNS) is working.
If the server cannot authenticate to AD, the wizard will fail with authentication errors even if the credentials are correct.

Check system and account prerequisites for the Directory Sync tool

Ensure the server meets the Directory Sync tool requirements:
- 64‑bit Windows Server (2003 SP2 or later, or later supported OS).
- Joined to an AD domain in the forest to be synchronized.
- Not a domain controller.
- .NET Framework 3.5 or later installed.
The user running the Configuration Wizard must be a member of the local MIIS Admins group created during installation.

If credentials are correct but authentication still fails

The issue can also occur when the sync server cannot properly authenticate with AD even though the account is valid.
In that case, apply the same remediation used for error 1789 (authentication failure to AD) on the sync server:
1. Restart the sync server and retry the wizard.
2. If the problem persists, remove the server from the domain and rejoin it:
  - Open System Properties → Computer Name → Change.
  - Temporarily join a Workgroup, restart.
  - Rejoin the correct Domain, restart again.
3. After rejoining, rerun the Directory Sync Configuration Wizard and re‑enter the Enterprise Admin credentials.

Rerun the Configuration Wizard

After completing the steps above, rerun the wizard and:
- Use a verified Enterprise Admin account.
- Ensure the server is domain‑joined and can reach domain controllers.
- Confirm that the wizard no longer reports failed-authentication or Invalid Credentials when retrieving the schema.

These steps address the common root causes: incorrect/insufficient AD credentials and the sync server being unable to authenticate to or contact Active Directory.

References: