Insufficient access rights Error Code 8344

Error Code 8344 KB ID 0001636

Problem

With Azure AD Replication, you may notice that you have the following error when you take a look at your connector status;

AAD Permission Issue Insufficient Rights Error Code 8344

Error: permission-issue
Connected data source error code: 8344
Connected data  source error: Insufficient access rights to perform this operation.

Solution: Error Code 8344

Firstly ensure that the user you are running AAD sync under, has the following permissions on the ‘root’ of your local AD domain.

  • Replicating Directory Changes: Allow
  • Replicating Directory Changes All: Allow

AAD Replication User Rights Error Code 8344

If the problem persists it’s usually because the account that is running the AAD sync does not have the appropriate rights to the mS-DS-ConsitencyGuid attribute for the affected users in the local Active Directory. The following commands will add the appropriate rights you ALL your local users;

$accountName = "Domain-Name\User-Name" 
$ForestDN = "DC=Domain-Name,DC=Domain-Extension"
$cmd = "dsacls '$ForestDN' /I:S /G '`"$accountName`":WP;ms-ds-consistencyGuid;user'"
Invoke-Expression $cmd

Grant AAD User Replication Rights

Lastly, if you have this problem on some ‘sporadic’ users, check to ensure that their individual user objects and inheritance enabled on their user object, before retrying.

 

Allow Inhritance on AD User

If the problem persists use the AD Connect Troubleshooter.

Fix Error Code 8344 with AD Connect Troubleshooter

Open Azure AD Connect > Configure.

Error Code 8344 Troubleshooter

Troubleshoot > Next > Troubleshooting > Launch.

Error Code 8344 Troubleshooting tool

Option 4 > Note: At this point you may or may not be asked to install the RTSAT tools, if so enter Y {Enter} > Option 12 > Y {Enter} > E {Enter} > Type in the name of the connector (in the example below that’s pnl.com).

Configure AD Connect Permissions

You will be prompted to authenticate with an administrative account > You will then have to accept each change, by typing A {Enter} You will need to do this SEVEN TIMES.

Error Code 8344 Reset Permissions

When complete force a full initial replication.

Start-ADSyncCycle -PolicyType Initial

At this point go an have a cup of coffee, then come back and check Synchronisation Service Manager. You should now be error free.

ix Error 8344 permissions

Related Articles, References, Credits, or External Links

NA

Author: PeteLong

Share This Post On

5 Comments

  1. enable inheritance worked for me, spot on once again!

    Post a Reply
    • This fixed it for us. Good job!

      Lastly, if you have this problem on some ‘sporadic’ users, check to ensure that their individual user objects and inheritance enabled on their user object, before retrying.

      Post a Reply
  2. Hello Sir ..

    I am facing same issue …I want to enable 2 attributes ,Replicating Directory Changes and
    Replicating Directory Changes Al.

    question is for which user I shall enabled these attributes ?
    A) Service account B) User which are showed up in error

    {Firstly ensure that the user u are running AAD sync under, has the following permissions on the ‘root’ of your local AD domain.”}

    Thanks in advanced

    Post a Reply
  3. A) Service account

    Post a Reply
  4. Yup, enable inheritance fixed it for me too.
    I had to enabled features to see the security tab.

    Thanks 🙂

    Post a Reply

Submit a Comment

Your email address will not be published. Required fields are marked *