← cd ~/events
// events/0 · Entra Connect
Event ID 0Password changes failed and scheduled for retry
With source Directory Synchronization, lists DNs of users whose password did not sync and will be retried. Microsoft also lists ID 0 among the events that indicate a connectivity problem.
| Log | Application |
|---|---|
| Source | Directory Synchronization |
| Area | Entra Connect |
What to check
If it persists, check the users are in sync scope and investigate connectivity.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 0 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Application log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Application" and EventID == 0
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Entra Connect events
- Event ID 601: Password hash sync manager starting
- Event ID 607: Password hash sync could not start
- Event ID 609: Password hash sync stopped
- Event ID 611: Error during password hash sync for a domain
- Event ID 613: Paused: full sync not completed
- Event ID 616: Connection to preferred DC failed
- Event ID 617: Full password hash sync started for forest
- Event ID 621: Full password hash sync attempt failed