Event ID 616Connection to preferred DC failed

What to check

Check the preferred DC is up and reachable from the Connect server.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 616 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Application log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Application" and EventID == 616
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Entra Connect events

• Event ID 601: Password hash sync manager starting
• Event ID 607: Password hash sync could not start
• Event ID 609: Password hash sync stopped
• Event ID 611: Error during password hash sync for a domain
• Event ID 613: Paused: full sync not completed
• Event ID 617: Full password hash sync started for forest
• Event ID 621: Full password hash sync attempt failed
• Event ID 622: Full password hash sync completed for a domain

Search all 123 event IDs →