Event ID 611Error during password hash sync for a domain

What to check

Read the exception text. Microsoft treats 611 as a connectivity problem with the named forest; some older RPC errors were fixed by updating the sync tool.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 611 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Application log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Application" and EventID == 611
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Entra Connect events

• Event ID 601: Password hash sync manager starting
• Event ID 607: Password hash sync could not start
• Event ID 609: Password hash sync stopped
• Event ID 613: Paused: full sync not completed
• Event ID 616: Connection to preferred DC failed
• Event ID 617: Full password hash sync started for forest
• Event ID 621: Full password hash sync attempt failed
• Event ID 622: Full password hash sync completed for a domain

Search all 123 event IDs →