ADSync service is not restarting

Question

ADSync service is not restarting

Randy Ordona 0

ADSync unable to connect to the Synchronization service. I followed all the steps and its still not starting.

Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator

2026-09-10T09:18:53.8333333+00:00
@Randy Ordona

The "unable to connect to the Synchronization Service" message is occurring because the Microsoft Entra ID Sync (ADSync) Windows service is not running. The message itself does not identify the reason the service stopped.

The next step is to identify the corresponding Windows System, ADSync, or SQL LocalDB event. The most common causes are a service-account password or GPO logon-right change, an inaccessible ADSync encryption key, SQL LocalDB corruption or capacity problems, or an unsupported Microsoft Entra Connect version.

Please provide:

The complete error returned when the Microsoft Entra ID Sync service is started manually.

Relevant System events from Service Control Manager, especially events 7038 or 7041.

Relevant Application events from ADSync and SQLLocalDB.

The installed Microsoft Entra Connect version.

Whether the service account password, service Log On account, domain GPOs, server backup configuration, or Microsoft Entra Connect version recently changed.

The SQL LocalDB error.log if ADSync events show a database login timeout.

We do not recommend changing the ADSync service identity, deleting the synchronization database, or replacing SQL database files until the event signature confirms the applicable recovery procedure.

Capture the failure before making more changes,
Start-Service ADSync - Record the complete error returned by Start-Service.

1 answer

Your answer

Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator

2026-09-10T09:18:53.8333333+00:00

@Randy Ordona

The "unable to connect to the Synchronization Service" message is occurring because the Microsoft Entra ID Sync (ADSync) Windows service is not running. The message itself does not identify the reason the service stopped.

The next step is to identify the corresponding Windows System, ADSync, or SQL LocalDB event. The most common causes are a service-account password or GPO logon-right change, an inaccessible ADSync encryption key, SQL LocalDB corruption or capacity problems, or an unsupported Microsoft Entra Connect version.

Please provide:

The complete error returned when the Microsoft Entra ID Sync service is started manually.

Relevant System events from Service Control Manager, especially events 7038 or 7041.

Relevant Application events from ADSync and SQLLocalDB.

The installed Microsoft Entra Connect version.

Whether the service account password, service Log On account, domain GPOs, server backup configuration, or Microsoft Entra Connect version recently changed.

The SQL LocalDB error.log if ADSync events show a database login timeout.

We do not recommend changing the ADSync service identity, deleting the synchronization database, or replacing SQL database files until the event signature confirms the applicable recovery procedure.

Capture the failure before making more changes,
Start-Service ADSync - Record the complete error returned by Start-Service.

Answer 1

If ADSync still does not start, check the two most common causes first:

Open Services.msc and try to start Microsoft Entra ID Sync.
- If it fails with Error 1069 or Event ID 7038, the ADSync service account password in the service logon settings is incorrect.
- Update the password in Services.msc for the ADSync service account.
If the service still fails and Event Viewer shows Event ID 6028 with "The server encryption key cannot be accessed", the sync service can no longer retrieve its encryption key after the password change.
- In that case, follow the Abandoning the ADSync service account encryption key process.
- On the Microsoft Entra Connect Sync server, open PowerShell.
- Run:
```
     $credential = Get-Credential
     Add-ADSyncAADServiceAccount -AADCredential $credential
```
- This resets the Microsoft Entra service account password and updates it in Microsoft Entra ID and the sync engine.
- Then restart Microsoft Entra ID Sync from Services.
Verify the ADSync service account itself:
- The account is not expired or disabled.
- User must change password at next logon is not enabled.
- The password is not expired.
Check required user rights assignment for the ADSync service account in local and domain Group Policy:
- Allow log on locally
- Log on as a batch job
- Log on as a service
- If these were changed through GPO, restart the server after correcting them.
Review Event Viewer:
- Check Application and System logs for directory synchronization events.
- This helps confirm whether the failure is a logon problem, encryption key problem, or policy/permissions issue.

A practical end-to-end path is:

Check Services.msc start error.
Check Event Viewer for 7038 or 6028.
If password-related, update the ADSync service logon password.
If encryption-key-related, run Add-ADSyncAADServiceAccount -AADCredential $credential.
Verify the account status and required logon rights.
Restart the server if GPO rights were changed.

References: