Skip to content
Create Ticket
  • There are no suggestions because the search field is empty.

Troubleshooting Directory and Legacy Password Sync: Service Account Format Requirements

A guide to resolving "Failed to read domain info" and "Access is denied" validation errors caused by unqualified service account usernames.


The Scenario

When configuring Directory Synchronisation or Legacy Password Sync within the central PowerSyncPro console or via the Remote Sync Agent Configuration utility, administrators must supply an Active Directory service account with delegated permissions to read, create, and write directory objects.

Even when using an account holding Domain Admin, Enterprise Admin, or highly privileged delegated rights, connection and validation tests may fail with immediate authentication errors. This occurs if the username is entered without its domain context.

Universal Best Practice: The Safest Format - While PowerSyncPro supports multiple formats, we highly recommend using the NETBIOS\sAMAccountName format for your service accounts across all migration scenarios (including Attribute Sync, Offline Domain Join (ODJ), Password Sync, SID History, and Target Domain Joins). This format avoids authentication failures related to non-routable UPN suffixes or cross-forest trust routing. 

Diagnostic Signs

If your sync profiles or agent configurations are failing to validate, check for the following symptoms:

  • Console or Agent Errors: The configuration interface or the local event logs throw errors such as:
    • Failed to read domain info
    • Access is denied
  • Unqualified Username: The service account username is entered as a flat string (e.g., SyncAccount) in the configuration panel.

The Cause: Local Account Interpretation

Under the hood, PowerSyncPro parses credentials programmatically to determine the security context required to query Active Directory.

By default, the PowerSyncPro installation and configuration modules look specifically for a domain-qualifying character—either a backslash (\) or an at-symbol (@)—to split and evaluate the logon string.

 Additionally, if you do opt to use the UPN format (user@domain.com), you must adhere to two strict Active Directory rules:

  • The Left-Side Rule: The left part of the UPN (before the @) must match the account's pre-Windows 2000 logon name (sAMAccountName) exactly. This means the prefix cannot exceed 20 characters.
  • The Right-Side Rule: The right part of the UPN (after the @) must resolve to the domain's actual Fully Qualified Domain Name (FQDN) rather than an alternate or public UPN suffix.

Supported vs. Unsupported Formats

To ensure PowerSyncPro successfully binds to the Active Directory domain interfaces, you must use one of the two supported qualified logon formats:

Format Type Syntax Example Status / Recommendation
Down-Level Logon Name NETBIOS\sAMAccountName CONTOSO\SyncAccount Highly Recommended (Safest for all scenarios; sAMAccountName portion is limited to a maximum of 20 characters)
User Principal Name (UPN) sAMAccountName@FQDN syncaccount@contoso.local Supported (Left side must match sAMAccountName and is limited to a maximum of 20 characters; right side must be the domain's FQDN)
Flat Username Username SyncAccount Unsupported (Will fail)

Resolution

Update Directory Configuration in the Console

If directory sync is configured without a Sync Agent on the PowerSyncPro Server:

  1. Log in to the PowerSyncPro Admin Portal.
  2. Navigate to Settings > Directories.
  3. Select your target directory and open its configuration parameters.
  4. Update the Username field using either the UPN or NETBIOS\Username format.
  5. Click Save.

Update the Remote Sync Agent Utility

If you are utilizing a Remote Sync Agent to allow PowerSyncPro access to remote directories:

  1. Log on to the member server hosting the Remote Sync Agent.
  2. Launch the PSP Sync Agent Configuration application.
  3. Select your configured domain and click Edit (or double-click the domain name).
  4. Update the Username field using either the UPN or NETBIOS\Username format.
  5. Click Test Connection. You should see a popup confirming a successful connection.
  6. Click Apply changes, then click Save Changes / Save and Exit.