• State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 94 subscribers
  • Views 7967 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Error projecting user accounts in AD, sync editor, user_password_Set, HResult: 80072035

gvollmering
over 7 years ago

Hello, 

I have an issue with projecting new users into AD in my development install.  The process ends in error with the following :

   Internal error in COM access layer: number: 80072035: The server is unwilling to process the request.

I have researched the Windows AD error online with many of the comments relating to complexity of password not conforming to policy, as well as the connecting user on the domain not having the required rights to create the projected user.  Here are the pertinent details regarding the projection:

  1. The job server resides on a parent domain (a) and is connected to target domain (b) by one-way trust
  2. Job service login user is  domain admin in domain (a)
  3. Sync editor connection to domain (b) is using a domain admin user in domain (b)
  4. Initial synchronization using synchronization project (bullet 3.) from AD into ADSAccount  table in One Identity was successful
  5. After attaching a sample person to account definition, ADS_ADSAccount_Insert fails at AdHocProjection
  6. I have altered the job log to level TRACE and reveals the following
    1. JobServer: error message breaks after the entry "vrtPassword should be set."
    2. StudioProcessor:   "Error executing user_password_Set on object" ... "Error: Exception has been trhown by the target of an invocation.)."
  7. We have successfully set the password manually for a test user on the domain with the domain admin account used in sync connection using the initial password value. 
  8. ADSAccount table has initial password set in UserPassword column correctly.
  9. vrtPassword mapping in the User class on Synchronization project has been left standard.  No modifications to the mapping has been made.

Because the error thrown shows immediately after trying to set property vrtPassword, there seems to be an issue with the password or its value. But, we have successfully set a password manually.

Thanks in advance for any recommendations.

  • 0 over 7 years ago
    Check to see if you are able to create an account when you exclude vrtPassword from the mapping on the user object
  • 0 over 7 years ago
    I did remove support for vrtUserPassword in the provisioning workflow. Everything else is standard out-of-the-box within the AD Sync Editor project. When testing without the vrtUserPassword support, the account is created successfully during the provisioning workflow. It seems that the problem does lie with the vrtUserPassword attribute.
  • 0 over 7 years ago
    The problem was resolved; the problem was rooted in the DNS entries in the parent domain. When synchronization editor check the password policy, it could resolve to the domain to check it. Synchronization could not set the password unless it understood that it satisfied the password domain policy.