Where can target preferred DCs for Entra Connect Sync ?

Question

Where can target preferred DCs for Entra Connect Sync ?

Mendoza Joshua 20

I’m running into a snag where password reset requests in Microsoft Entra ID fail for branch office users because the on-prem Domain Controller responses exceed the 30‑second Password Writeback window. I need to figure out how to target preferred DCs for Entra Connect Sync so that resets don’t time out. Any guidance or best practices would be super helpful!

0 comments

2 answers

Your answer

Answer 1

Hello Mendoza Joshua,

What you’re seeing with password writeback timing out is often caused by the connector reaching out to a domain controller that’s geographically distant or overloaded, which pushes the response beyond the 30‑second window.

The recommended approach is to configure preferred domain controllers for Entra Connect. You can do this by editing the miiserver.exe.config file on the Entra Connect server and specifying the preferredDCs attribute, listing the hostnames of the DCs you want the connector to prioritize. This ensures that password writeback requests are sent to local or high‑performing DCs first. Another best practice is to verify that your AD site and subnet mappings are correct, so the connector can naturally select the closest DCs based on topology.

You can also monitor DC response times with tools like repadmin /showrepl and event logs to confirm which controllers are slow. If needed, adjust site link costs in Active Directory to discourage referrals to remote DCs. Finally, make sure your Entra Connect server itself is placed in the same site as the preferred DCs to minimize latency.

I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

Jason.

Answer 2

Yes. In Microsoft Entra Connect Sync, target preferred domain controllers in the Active Directory connector.

Use this path:

Open Synchronization Service Manager.
Go to the Connectors tab.
Select or right-click the applicable Active Directory connector, then open Properties.
In Connector Designer, select Configure Directory Partitions.
Select the directory partition or domain.
In Domain controller connection settings, enable Only use preferred domain controllers.
Select Configure.
Add the domain controller names that Entra Connect should use.
Restart the Microsoft Entra ID Sync (ADSync) service to apply the change.

Best practices supported by the documentation:

Use the same domain controller consistently while testing or making changes.
Prefer the nearest domain controller for the affected branch office, or the domain controller that holds the PDC emulator role.
If needed, test with different domain controllers to determine whether the timeout is isolated to one DC.
In Active Directory Users and Computers, connect to the same domain controller used by Microsoft Entra Connect when validating password changes.
If the Connect server cannot reliably reach all domain controllers, configuring Only use preferred domain controllers is specifically recommended.

If password writeback issues continue after targeting preferred DCs, also verify that the connector account has the required Active Directory permissions for password writeback.