Entra Connect Password Writeback Fails Due to RPC Filtering

Ahmad Ibrahim 60 Reputation points
2026-09-01T02:20:56.99+00:00

Cloud password resets fail to sync back to on-prem AD. How can we restrict RPC ports for AD Sync without breaking password writeback?

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
0 comments
Answer accepted by question author
VPHAN 43,155 Reputation points Independent Advisor
2026-09-01T02:56:07.9566667+00:00

Hi Ahmad,

Microsoft Entra Connect password writeback operates strictly via outbound HTTPS (TCP 443) to the Azure Service Bus relay, requiring no inbound ports on your external firewall. To restrict internal dynamic RPC traffic between the sync server and Domain Controllers across internal firewalls, pin static service ports in the registry by setting the DWORD TCP/IP Port under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters and DCTcpipPort under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters. Update your internal firewall to allow traffic over TCP 135 for the RPC Endpoint Mapper, your assigned static ports, and standard Active Directory baseline ports (53, 88, 389, 636, and 445). If writeback issues persist—commonly indicated by Event IDs 31014 or 6100—verify that the on-premises AD DS connector account has explicit permissions to Reset Password, Change Password, Write lockoutTime, and Write pwdLastSet on target user objects.

VPHAN

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.