Three hybrid identity features depend on software or accounts in your on-premises Active Directory: Microsoft Entra Password Protection (a DC agent plus a proxy), pass-through authentication (PTA) agents, and Seamless single sign-on (the AZUREADSSOACC computer account). When they fail, the evidence is mostly on-premises: event IDs, agent messages and health tests. This quick reference lists what Microsoft documents for each, with the meaning, the usual cause and the first check. The AADSTS 800xx (PTA) and 810xx (Seamless SSO) sign-in codes are in part 3 of the AADSTS list.
Codes in this quick reference
Event ID 10014 / 10015: password change / set validated as compliantDCAgent Admin logEvent ID 10016 / 10017: password change / set rejected by the Azure password policyDCAgent Admin logEvent ID 30002 / 30003: rejected, matched the custom banned password listDCAgent Admin logEvent ID 30004 / 30005: rejected, matched the Microsoft global banned password listDCAgent Admin logEvent ID 30026 / 30027: rejected, matched both the Microsoft and custom listsDCAgent Admin logEvent ID 30021 / 30022: rejected, password contains the user name or a friendly nameDCAgent Admin logEvent ID 10024 / 10025: audit-only, password would have been rejected but was acceptedDCAgent Admin logEvent ID 30008 / 30007: audit-only, would have failed the custom banned listDCAgent Admin log
+ 41 more codes in the tables below.
How to read these errors#
- Password Protection: on each DC, Applications and Services Logs › Microsoft › AzureADPasswordProtection › DCAgent › Admin is the main log (Operational and Trace exist; Trace is off by default). Event ranges: 10000–19999 password filter DLL, 20000–29999 service host, 30000–39999 policy logic. A rejected password logs two events sharing a CorrelationId. The proxy logs to …\ProxyService\Admin and Operational.
- PTA: agent status in the Microsoft Entra admin center (Entra Connect), the Microsoft › AzureAdConnect › AuthenticationAgent › Admin log, per-sign-in traces in
%ProgramData%\Microsoft\Azure AD Connect Authentication Agent\Trace\, and setup errors in%ProgramData%\AADConnect\trace-*.log. - Seamless SSO: the sign-in log error code,
kliston the client, and event 4769 on DCs with success auditing enabled.
PowerShell
# Password Protection (AzureADPasswordProtection module)
Get-AzureADPasswordProtectionSummaryReport -DomainController dc01
Get-AzureADPasswordProtectionDCAgent | Format-Table ServerFQDN, SoftwareVersion, PasswordPolicyDateUTC, HeartbeatUTC, AzureTenant
Test-AzureADPasswordProtectionProxyHealth -TestAll
Test-AzureADPasswordProtectionDCAgentHealth -TestAll
# PTA, on an Authentication Agent server
Import-Module "C:\Program Files\Microsoft Azure AD Connect Authentication Agent\Modules\PassthroughAuthPSModule\PassthroughAuthPSModule.psd1"
Invoke-PassthroughAuthOnPremLogonTroubleshooter
net helpmsg 1328Password Protection: password validation events#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
| Event ID 10014 / 10015 | Password change / set validated as compliant | Normal | Proves this DC's agent processed it |
| Event ID 10016 / 10017 | Password change / set rejected | A banned token; the paired 300xx event says which list | Read the event with the same CorrelationId |
| Event ID 30002 / 30003 | Rejected by the custom banned list | Organization-specific term | Expected in Enforce mode |
| Event ID 30004 / 30005 | Rejected by the Microsoft global list | Commonly used weak password | Expected |
| Event ID 30026 / 30027 | Rejected: tokens from both lists | Combined weak terms | Expected |
| Event ID 30021 / 30022 | Rejected: contains the account name or a friendly name | User name in the password | Expected |
| Event ID 10024 / 10025 | Audit only: would have been rejected, was accepted | Policy in Audit mode | Switch to Enforce when ready |
| Event ID 30008 / 30007 | Audit only: custom list | Audit mode | Same as above |
| Event ID 30010 / 30009 | Audit only: Microsoft list | Audit mode | Same as above |
| Event ID 30028 / 30029 | Audit only: combined lists | Audit mode | Same as above |
| Event ID 30024 / 30023 | Audit only: user name | Audit mode | Same as above |
| Event ID 10012 / 10013 | Password change / set errors | The filter can't reach the DC agent service; passwords are accepted meanwhile | Start the DC agent service |
Password Protection: agent, proxy and policy problems#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
| Event ID 30001 | Password accepted: no Azure password policy available yet | Forest or proxy not registered, no network path to a proxy, or no connectivity to other DCs | Register-AzureADPasswordProtectionForest, Register-AzureADPasswordProtectionProxy |
| Event ID 30006 | The service is now enforcing the following Azure password policy. | New policy downloaded | Read the Enabled and AuditOnly values |
| Event ID 30019 | Policy disabled: passwords accepted unprocessed | Enable mode set to No | Expected only during emergency remediation |
| Event ID 30016 | The forest hasn't been registered with Azure. | Not registered, or a Windows Server 2012/2012 R2 DC can't decrypt the registration | Register the forest; upgrade those DCs |
| Event ID 30017 | No proxy found in the directory | No proxy registered, or AD replication delay | Register a proxy; allow replication |
| Event ID 30018 | Can't communicate with a proxy | Isolated subnet; firewall blocking TCP 135 or the proxy's RPC port; DCs missing Access this computer from the network on the proxy | Restore the installer's firewall rules; grant that right to all DCs |
| Event ID 10023 | DC in Directory Services Repair Mode: all passwords approved | DSRM boot | Expected until the next normal boot |
| Event ID 10021 / 10022 | Preview agent trial expiring / expired: all passwords approved | Public preview build | Upgrade the DC agent |
| Event ID 30034 / 20002 (Operational) | Newer DC agent / proxy version available | Update released | Upgrade; the DC agent has no auto-upgrade despite the message |
No proxy certificates were found - please run the Register-AzureADPasswordProtectionProxy cmdlet to register the proxy. | VerifyProxyRegistration failed | Proxy never registered | Register it |
The RPC endpoint mapper on the specified proxy returned no results | VerifyProxyConnectivity failed | Proxy service stopped | Start the service on that server |
VerifyEncryptionDecryption Failed | KDS encryption or decryption broken | KDS can't start (DC object outside the Domain Controllers OU, or KDS disabled), or mixed 2012/2012 R2 and 2016+ DCs | net start kdssvc; move the DC object; don't mix those OS versions |
WIN32 Error Code: 0xa91 Error Message: Password doesn't meet the requirements of the filter dll's | ntdsutil rejected a new DSRM password | Weak DSRM password | Pick a stronger one; the event shows no user name |
The Directory Services Restore Mode password doesn't meet a requirement of the password filter(s). | Replica promotion blocked | Weak DSRM password checked by an existing DC | Supply a stronger password |
| Weak passwords accepted | Policy not applied | Audit mode, disabled policy, expired preview agent, or the change hit a DC without the agent | Look for a validation event for that user; install the agent on every DC |
Also compare the AzureTenant value across all agents and proxies (they must match; re-register if not). A stale HeartbeatUTC (normally refreshed about hourly) means the agent stopped, was removed or the DC was demoted.
Pass-through authentication agent errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
| PTA agent shows Inactive | The agent isn't serving requests | Agent service down or unreachable | Feature Enabled, agents Active; keep more than one |
An unexpected error occurred | Agent installation or registration failed | Varies | Collect agent logs; contact support |
| Registration of the Authentication Agent failed due to blocked ports | Agent can't reach the service | Firewall or proxy | Open the documented URLs and ports |
| Registration of the Authentication Agent failed due to token or account authorization errors | Wrong account | Not a cloud-only Hybrid Identity Administrator; known issue with MFA-enabled accounts | Use a cloud-only Hybrid Identity Administrator; Microsoft's workaround is to turn MFA off for that operation only |
| Enabling the feature failed because there were no Authentication Agents available | PTA can't be enabled | No active agent | Install Entra Connect or a standalone agent first |
Users will not be able to sign-in to Microsoft Entra ID unless you have other Pass-through Authentication agents installed on other servers. | Uninstall warning | Removing the last agent | Add agents elsewhere first |
| Invalid username or password while the agent works | Password validated, user still fails | On-premises UPN differs from the cloud UPN (non-routable), or the Entra Connect server isn't domain-joined | Run Invoke-PassthroughAuthOnPremLogonTroubleshooter; consider Alternate Login ID |
Passthrough Authentication request failed. RequestId: '...'. Reason: '1328'. | Trace log entry for one failed sign-in | Reason is a Win32 error code | Decode it with net helpmsg; common values below |
Reason 1326 ERROR_LOGON_FAILURE | The user name or password is incorrect. | Wrong password | User side |
Reason 1327 ERROR_ACCOUNT_RESTRICTION | Account restrictions prevent the sign-in | Policy restriction | Check the account's restrictions |
Reason 1328 ERROR_INVALID_LOGON_HOURS | Time restrictions on the account | Logon hours | Review logon hours |
Reason 1329 ERROR_INVALID_WORKSTATION | This user isn't allowed to sign in to this computer. | Logon To list excludes the PTA servers (agents call LogonUser) | Add every agent server to the list |
Reason 1330 ERROR_PASSWORD_EXPIRED | The password for this account has expired. | Expired AD password | Reset it on-premises |
Reason 1331 ERROR_ACCOUNT_DISABLED | Account disabled | Disabled in AD | Enable it if intended |
With auditing on, the agent server's Security log records each validation by AzureADConnectAuthenticationAgentService.exe. The counters # PTA authentications and # PTA authentication errors show load and failures; agents provide high availability, not load balancing, so one may see no traffic.
Seamless SSO failures#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
| Sign-in codes 81001–81013 | Kerberos ticket problems | See the guide | Guide |
| AZUREADSSOACC computer account missing or disabled | No ticket can be issued | Cleanup deleted or disabled it | Recreate it: Disable-AzureADSSOForest, then Enable-AzureADSSOForest |
https://autologon.microsoftazuread-sso.com in Trusted sites | Sign-in blocked | Wrong zone | Put it in the Local intranet zone |
| AzureADSSOAcc$ moved from RC4_HMAC_MD5 to AES | SSO stops | Key not rolled over first | Roll over the Kerberos decryption key |
| Clock more than five minutes off | Kerberos fails | Time sync | Fix time on the device and DCs |
| Still no SSO after re-enabling | Old tickets cached (typically 10 hours) | Disable and re-enable | klist purge, then retry |
| 30 or more AD forests | Can't enable in Entra Connect | Wizard limit | Enable the feature manually |
| 25600-character policy limit | Can't add more forests | Many forests in the policy | Enable one forest per trust; trusted forests inherit it |
Disable-AzureADSSOForest / Enable-AzureADSSOForest fails | Forest operation fails | Domain admin in Protected Users, or name not in SAM format | Use another domain admin as contoso\johndoe |
Event ID 4769 with ServiceName AZUREADSSOACC$ | A ticket was issued for Seamless SSO | Normal sign-in | Absent: the browser never asked (zone, network or Entra join SSO first) |
In a few cases, enabling takes up to 30 minutes. Microsoft lists no support in Firefox private browsing, Internet Explorer Enhanced Protected Mode or mobile browsers. Kerberos failure codes in 4769 events are in the Kerberos reference.
How to verify a fix#
- Password Protection: both
-TestAllhealth tests return Passed, every DC shows a freshHeartbeatUTC, and a banned test password on a DC with the agent logs 10016 plus a 300xx event. - PTA: every agent is Active, a test sign-in succeeds and the trace folder shows no new failures.
- Seamless SSO:
klistlists a ticket for AZUREADSSOACC, the DC logs 4769, and the sign-in completes without a password prompt.Get-AzureADSSOStatuslists every forest.
Choosing between these methods is covered in PHS vs PTA vs federation.
References#
- Monitor on-premises Microsoft Entra Password Protection (Microsoft Learn)
- Troubleshoot on-premises Microsoft Entra Password Protection (Microsoft Learn)
- Troubleshoot Microsoft Entra pass-through authentication (Microsoft Learn)
- Troubleshoot Microsoft Entra seamless single sign-on (Microsoft Learn)
- System Error Codes 1300-1699 (Microsoft Learn)
