Active Directory Integration: Troubleshooting Password Synced Issues

Open [Sync Logs] from the Access Control Administration.
Click each row to view the details of the sync.
Check if the most recent logs include entries starting with "Start password syncing".

Note: Logs displaying "HDE One Directory Sync version x.x.x" or "Start syncing" are user sync logs and are not relevant for this case.

• If no logs are generated: proceed to Is the HDE One Password Sync service running?
• If errors are present: proceed to Does the relevant user exist in Access Control?
• If logs are output normally without errors: proceed to By Case (Internal System Configuration Changes)

1. On the sync server (the server where HDE Directory Sync Tool is installed), open [Administrative Tools] – [Services].
2. Check that the [Status] of "HDE One Password Sync" is "Running".

• If the status is not "Running"

  Right-click HDE One Password Sync and select "Start".
  * If the service stops immediately after starting, please refer to the following sections in this article.

  • Are the permissions for the user running the password sync service (HDE One Password Sync) set appropriately?
  • Are you using a web proxy or URL filtering for internet communication?

• If the status is "Running"

  Please refer to the following article and try restarting the service.
  Restarting HDE One Directory Sync and HDE One Password Sync

The user running the HDE Directory Sync Tool service (*) requires the following three permissions:

• Domain Admins
• Enterprise Admins
• Schema Admins

The user running the HDE Directory Sync Tool is set as follows.
Please check on the sync server (the server where HDE Directory Sync Tool is installed).

• config.ini located in the C:\Program Files\HDE One Directory Sync\ folder
  * If you modify config.ini, you must restart the service.
• Open the properties of the following services from [Administrative Tools] – [Services] on the sync server, and check the [Log On] tab:
  HDE One Directory Sync
  HDE One Password Sync

If you are using a web proxy or URL filtering for internet access from your internal network, communication with HENNGE may be blocked.
Please refer to the following article and update your network settings to allow (whitelist) communication to the Access Control URLs (FQDNs).
HENNGE One Supported Environments

If possible, consider configuring your environment to bypass the web proxy.

To perform password synchronization, HDEPasswordFilter.dll must be installed on all Active Directory 2016 and later servers.

1. On Active Directory, open the following folder:
   C:\WINDOWS\System32\
2. Check if the file "HDEPasswordFilter.dll" exists in the folder.
3. If the file does not exist, please refer to Installing HDEPasswordFilter.dll on All Domain Controllers (WS 2016 and later) and install HDEPasswordFilter.dll.

There may be missing configurations on the newly added Active Directory server.
Please check Is HDEPasswordFilter.dll installed correctly?

Please check the following three points:

1. The IP address and hostname of the Active Directory server have changed

   Open config.ini on the sync server (the server where HDE Directory Sync Tool is installed) and check if the IP address or hostname specified in the server= variable is still the old one. Update it to the latest information and save.
   File location: C:\Program Files\HDE One Directory Sync
   After making changes, restart the following two services from [Administrative Tools] – [Services] on the server.

   • HDE One Directory Sync
   • HDE One Password Sync

2. HDEPasswordFilter.dll was not installed after building the Active Directory server

   Please check Is HDEPasswordFilter.dll installed correctly?

3. The Active Directory server was replaced, but the sync server (the server where HDE Directory Sync Tool is installed) remains the same

   Please contact HENNGE One Technical Support with the details of what was performed and the current situation.

On the new sync server, check that the HDE Directory Sync Tool is installed and that the configuration file (config.ini) has been properly transferred from the old server.
Also, check Are password sync logs being generated?

* If you are unsure about the installation status of the HDE Directory Sync Tool, please contact HENNGE One Technical Support with the details of what was performed and the current situation.

When a password is changed in Active Directory, the HDE One Password Sync service syncs the user's unixUserPassword value as the password.
unixUserPassword is automatically updated by the HDEPasswordFilter.dll function when a user's password is changed on an Active Directory domain controller.
When changing a password from a Windows device, the change is applied to one of the Active Directory domain controllers.
After that, replication (sync) occurs to other Active Directory domain controllers. If the domain controller where the password was initially changed is not functioning properly, password sync by the HDE One Password Sync service will not work correctly.

Please follow the steps below to check if there are any servers where the HDEPasswordFilter.dll function is not working properly.

----------------------------------------------------------

1. Log in to the Active Directory domain controller.

2. From [Active Directory Users and Computers], open the properties of the relevant user and go to the [Attribute Editor] tab (*1) to check the value of "unixUserPassword".

   
   (*1) If the [Attribute Editor] tab is not displayed, check [View] – [Advanced Features] in the [Active Directory Users and Computers] window.

   

3. Reset the password for the relevant user on the currently logged-in Active Directory domain controller.
4. Check the value of "unixUserPassword" again in the [Attribute Editor] of the user's properties. If it has changed, HDEPasswordFilter.dll is working correctly.

----------------------------------------------------------

If there are any servers where the value of "unixUserPassword" does not change after a password change, please check Is HDEPasswordFilter.dll installed correctly?