Windows Integration Errors

How to Troubleshoot Azure AD Connect Password Hash Sync Event 611

Nimra Malik Oct 12, 2026 868 views

Question details

The user needs to resolve Event ID 611 during Azure AD Connect password hash synchronization in a multi-forest environment.

How to Troubleshoot Azure AD Connect Password Hash Sync Event 611

Product: Azure AD Connect
Device & OS: Windows Server
Scenario: Synchronizing password hashes across a multi-forest Active Directory environment using the Azure AD Connect client.
Observed behavior: The system generates Event ID 611 because a domain controller hostname or IP address in the affected forest cannot be resolved.

Before you start

Ensure you have administrative access to the on-premises domain controller running Azure AD Connect and have basic network command-line tools available.

Solution 1Recommended

Verify DNS Resolution and Domain Controller Connectivity

Ensure the Azure AD Connect server can correctly resolve and communicate with domain controllers in the target forest to fix synchronization failures.

Event 611 is primarily a network and DNS resolution issue between the Azure AD Connect client and the target forest's domain controllers. Validating connectivity often resolves the sync failure.

Test DNS Resolution

Open Command Prompt on the Azure AD Connect server and run 'nslookup [DomainControllerHostname]' to verify that the hostname resolves to the correct IP address.

Verify Network Connectivity

Use the 'ping' command followed by the target domain controller's IP address to ensure ICMP packets can reach the destination forest without being blocked by a firewall.

Remove Outdated Preferred Controllers

Open the Synchronization Service Manager, navigate to the Active Directory Domain Services connector properties, and remove any outdated or unreachable preferred domain controller settings from the 'Configure Directory Partitions' tab.

Connectivity Restored: Once DNS resolves correctly and outdated preferred servers are cleared, the password hash sync should resume normally during the next cycle.

Solution 2

Review Supported Topologies and Collect Logs

Validate your multi-forest setup against Microsoft documentation and gather diagnostic logs for deeper analysis.

Solution 3

Escalate to Support Safely

Seek assistance from the Microsoft Entra or Azure AD Connect support team while protecting your network's sensitive data.

Free Microsoft Office alternative

Document Your IT Infrastructure with WPS Office

While resolving Azure AD Connect server events requires specialized administrative tools, documenting your IT topologies, IP schemas, and server configurations shouldn't require an expensive software subscription. WPS Office provides IT professionals with a lightweight, secure, and fully compatible alternative to Microsoft Office.

1. Download the Installer: Visit the official WPS Office website and download the free installation package.
2. Install the Software: Run the downloaded executable file and follow the standard on-screen prompts to install the suite.
3. Start Documenting: Launch WPS Writer or Spreadsheets to begin managing your server configurations and network topology documentation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx) for seamless sharing of IT documentation.Lightweight installation that consumes minimal server or workstation resources, perfect for IT admin environments.Built-in PDF tools for securely exporting, encrypting, and sharing network topology diagrams and incident reports.Familiar tabbed interface allowing you to manage multiple server logs and spreadsheets in a single optimized window.

microsoft office alternative - wps office

Frequently Asked Questions

What causes Event ID 611 in Azure AD Connect?

Event ID 611 typically occurs in multi-forest environments when the Azure AD Connect server cannot resolve the hostname or reach the IP address of a domain controller in one of the connected forests.

How do I remove an outdated preferred domain controller in Azure AD Connect?

Open the Synchronization Service Manager, navigate to the Connectors tab, right-click the specific Active Directory Domain Services connector, select Properties, and update the settings under 'Configure Directory Partitions' to clear any unreachable controllers.

Is Password Hash Sync supported in all multi-forest setups?

Password Hash Synchronization is supported in most multi-forest topologies, provided there is proper network routing, functional DNS resolution, and appropriate trusts between the Azure AD Connect server and the target forests.

Why should I redact IP addresses when asking for IT help in forums?

Sharing real internal or external IP addresses and domain names in public forums can expose your network topology to potential security threats. Always use fictional examples like 10.0.0.1 or domain.com when seeking community assistance.

Microsoft Office Error Codes