Troubleshooting Password Agent Issues

• The ADSelfService Plus server could not be contacted or is unreachable, but ADSelfService Plus is accessible via the web browser in the specific domain controller.

• Native password resets are not being audited in the Reset Password Audit Report.

The ADSelfService Plus Password Sync Agent syncs native password changes (password change using the Ctrl+Alt+Del screen and password reset using the Active Directory Users and Computers portal) with enterprise applications integrated for password synchronization. This article provides instructions on how to troubleshoot issues that you may encounter while using the Password Sync Agent.

Case 1: The ADSelfService Plus server could not be contacted or is unreachable, but ADSelfService Plus is accessible via the web browser in the specific domain controller.

Solution 1:

• Stop the ADSelfService Plus service.
• Open the server.xml file (<installation directory>/conf) and navigate to the following section:
  <Connector SSLEnabled="true"
• TLS 1.2 should be the TLS version configured. To ensure this, check whether the following parameter is specified. If not, add it at the end of the section:
  <Connector SSLEnabled="true" acceptCount="100" compression="off"........ ...... ...... ............. SSLEnabledProtocols="TLSv1.2"/>
• Once TLS 1.2 is configured, confirm that the version 1.3.0 of the Password Sync Agent has been installed by opening the Control Panel, navigating to the Password Sync Agent icon and checking the version in the Version Column. Only Password Sync Agent versions 1.3.0 and higher support TLS v.1.2.
• Start ADSelfService Plus.

Solution 2:

Check if any proxy server is being employed to access the ADSelfService Plus server. If yes, configure the settings of that proxy server in the Internet Explorer since the Password Sync Agent uses the proxy server configured in the Internet Explorer.

Case 2: Native password resets are not being audited in the Reset Password Audit Report.

Solution 1:

• Check if the Sending data to log has been entered in the service log for the native password reset performed.

  Location of service log:
  • In 64-bit systems - C:\Program Files (x86)\ZOHO Corp\Password Sync Agent
  • In 32-bit systems - C:\Program Files\ZOHO Corp\Password Sync Agent
• Then check whether an error has been logged in the serverout log (<installation folder>\logs) for the preset action.

• If the No encryption key error is found in the serverout log, reconfigure the Password Sync Agent with the server name or IP address, port number, and protocol (HTTPS/HTTP) used by ADSelfService Plus. This can be done by following the steps below:

  • Right-click the Password Sync Agent icon on the system tray and select Edit Settings.
  • The Edit Settings dialog box will open.
  • Enter the Server Name/IP Address, Port Number, and Protocol (HTTPS/HTTP).
  • Click Save.

Solution 2: Reinstall the Password Sync Agent.

• In the domain controller where the Password Sync Agent is installed, go to Control Panel, click on the Password Sync Agent icon, and click Uninstall.
• Now, go to the folder where the Password Sync Agent MSI file (ManageEnginePasswordSyncAgent.msi) is present.
• Here, open Command Prompt as administrator, specify the Password Sync Agent's MSI filename (ManageEnginePasswordSyncAgent.msi), and press Enter.