> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-fault-finding-v8.md). # Active Directory Sync fault finding (v8.40 and below) Diagnose legacy Active Directory Sync service, certificate, and connection failures. ## Logs and trace Two apps log on the client workstation. Enable trace by editing the app config's `` `minlevel` to `"Trace"`: * Diagnostic client: `AdSyncDiagnosticClient.exe.config` in `C:\Program Files (x86)\Gallagher\Gallagher Active Directory Sync Diagnostic Client\bin` * Control app: `AdsControlApp.exe.config` in `C:\Program Files (x86)\Gallagher\Active Directory Sync Control` * Service log: `AdSyncService.log` in `C:\ProgramData\Gallagher\Command Centre` ![The AdSyncDiagnosticClient.exe.config open in Notepad with the NLog rule minlevel set to "Trace"](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-60700d8ed5adfb4c1fafe3cbb67ceb65c6136a9c%2FSECHUB-AD-SYNC-21-enable-trace-config.png?alt=media) ## Service not starting — common causes 1. **FT AD Sync Service account** lacks access to the certificate store (fix via [Sync User Accounts Requirement](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-user-accounts-re.md)). 2. **Certificate:** * *Client certificate* mismatch/missing: AD Sync cannot decrypt `repconfig.bin` in `C:\ProgramData\Gallagher\AdSyncService\RepConfig`; `ADSyncService.log` shows **"Padding is invalid and cannot be removed"**. Create a fresh client certificate if unsure and delete the non-working one. **Do not confuse the AD Sync *****server***** certificate with the *****client***** certificate.** * *Server certificate* thumbprint does not match the one generated by the AD Deployment utility (often a certificate retained from a previous install). 3. **Corrupted `repconfig.bin` / unrecoverable client certificate:** * *Corrupted:* delete `repconfig.bin`, rename `repconfig.old.bin` to `repconfig.bin`, restart the service. * *Lost certificate:* delete all `repconfig.bin`, restart the service. * The certificate must live in Certificate store **> Current User > Personal > Certificates**. 4. **FIPS mode enabled** on the AD Sync machine: `ADSyncService.log` shows a FIPS validation error. Disable FIPS via the registry (set the `Enabled` string to **`0`**). ![AdSyncService log showing a System.InvalidOperationException — "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms"](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-f9c3e77669851f4df46e126aec4e4b1d6b5208af%2FSECHUB-AD-SYNC-19-fips-error-log.png?alt=media) The **Web Server URI** must be FQDN+Port, not the IP: `protocol://[Resource name]:Port/ActiveDirectorySync/`. ## Connection issues Test with the Diagnostic client (checks client certificate, server address, credentials), or by opening the Web Service URI in a browser (a valid cert prompt = reachable; page-not-found = unreachable). ![AD Sync Diagnostic Client showing a failed connection (red X) with an EndpointNotFoundException](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-8fc56288257bfd561a17701b55b5161efb2a2a3b%2FSECHUB-AD-SYNC-20-diagnostic-connection-failed.png?alt=media) * *Is connected to AD = No:* check the DC computer name and credential in ``. * *Is connected to CC = No:* possible TLS issue on the Gallagher Server (see the "Unexpected logon result 403 / 403 Forbidden" troubleshooting). The Control App's **Statistics** and **Errors** tabs show replication counts and per-group errors while troubleshooting. ## Retrieving logs (summary) Stop replication on the client, then stop the FT AD Sync Service on the Web Service server. Set `AdsService.exe.config` `minlevel` to `"Trace"`, archive existing `AdSyncService*.log` from `C:\ProgramData\Gallagher\Command Centre`, restart the service, reproduce with a single replication group enabled, then collect `AdSyncService.log`. *** 🔗 **Related** * [Sync Checklist (v8.40 and below)](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-checklist-v8-40.md). Legacy setup and XML values. * [Sync User Accounts Requirement](/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-user-accounts-re.md). Certificate-store access. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/identity-solutions-cardholders-and-ope/active-directory/active-directory-sync-fault-finding-v8.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.