Event ID 609Password hash sync stopped

What to check

If unexpected, check whether the server is in staging mode or the service has stopped.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 609 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Application log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Application" and EventID == 609
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Entra Connect events

• Event ID 601: Password hash sync manager starting
• Event ID 607: Password hash sync could not start
• Event ID 611: Error during password hash sync for a domain
• Event ID 613: Paused: full sync not completed
• Event ID 616: Connection to preferred DC failed
• Event ID 617: Full password hash sync started for forest
• Event ID 621: Full password hash sync attempt failed
• Event ID 622: Full password hash sync completed for a domain

Search all 123 event IDs →