AD Connect Sync not autoupdating

Question

AD Connect Sync not autoupdating

Daniel Grønnemose 5

Hi,

We have an issue with our AD Cloud Connect - not autoupdating. Autoupdating has been enabled but nothing happens and the version of AD Cloud Connect is 2.2.8.0 - can we force it to upgrade to a newer version?

Daniel Grønnemose 0 Reputation points

2024-09-16T06:56:27.3133333+00:00

Hi Akinbade - thanks for getting back to me - you were right, we have issues showing in the event logs

Signing certificate for the MSI file 'C:\Windows\TEMP\tmpF834.msi' is not valid.
Signing certificate for the MSI file 'C:\Windows\TEMP\tmpF834.msi' is not valid. Error: 'Microsoft.ApplicationProxy.Common.Utilities.Certificates.CertificateValidation.CertificateValidationException: ErrorCode: 'InvalidChain' Certificate: 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington,
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-09-18T08:20:12.6966667+00:00

@Daniel Grønnemose Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Ibrahim Benna 0 Reputation points

2024-09-27T13:49:31.7233333+00:00

Hi all,

We are also seeing the exact same issue on our server. It is stuck on 2.2.8 and wont auto-upgrade. We are seeing the following errors in Event logs:

EVENT ID 32005

Signing certificate for the MSI file 'C:\Windows\TEMP\tmp8359.msi' is not valid. Error: 'Microsoft.ApplicationProxy.Common.Utilities.Certificates.CertificateValidation.CertificateValidationException: ErrorCode: 'InvalidChain' Certificate: 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'F8B9D82E2E34F627E0FDF6739B051553561690E0' Root CA: 'CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'8F43288AD272F3103B6FB1428485EA3014C0BCFE' Error: 'Unable to validate certificate chain: ChainElements:

EVENT ID 32002

Failed downloading new Microsoft Azure AD Connect Agent installer. Error: 'System.UnauthorizedAccessException: Access to the path 'C:\Windows\TEMP\tmp8359.msi' is denied.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

at System.IO.File.InternalDelete(String path, Boolean checkHost)

at Microsoft.ApplicationProxy.Common.Utilities.Installation.MsiRunner.Run(Byte[] msiBytes, String[] args, Predicate`1 msiFileValidator)

at Microsoft.Azure.ADConnect.AgentUpdater.Runtime.CheckForUpdateHandler.CheckForUpdate()'.

I confirmed .Net version is correct on the server
Ibrahim Benna 0 Reputation points

2024-10-01T16:10:09.75+00:00

So I have been doing some digging on this issue and noticed that the first certificate in the error ID 32005 wasnt anywhere on the server! I then checked the properties of the file downloaded by the updater in C:\windows\Temp and it has a code signing certificate attached to it -BUT ITS EXPIRED, since April 2024!

Unfortunately, it looks like it has to be a manual install or wait until Microsoft update the signing certificate on the install file.

3 answers

Your answer

Daniel Grønnemose 0 Reputation points

2024-09-16T06:56:27.3133333+00:00

Hi Akinbade - thanks for getting back to me - you were right, we have issues showing in the event logs

Signing certificate for the MSI file 'C:\Windows\TEMP\tmpF834.msi' is not valid.
Signing certificate for the MSI file 'C:\Windows\TEMP\tmpF834.msi' is not valid. Error: 'Microsoft.ApplicationProxy.Common.Utilities.Certificates.CertificateValidation.CertificateValidationException: ErrorCode: 'InvalidChain' Certificate: 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington,
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-09-18T08:20:12.6966667+00:00

@Daniel Grønnemose Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Ibrahim Benna 0 Reputation points

2024-09-27T13:49:31.7233333+00:00

Hi all,

We are also seeing the exact same issue on our server. It is stuck on 2.2.8 and wont auto-upgrade. We are seeing the following errors in Event logs:

EVENT ID 32005

Signing certificate for the MSI file 'C:\Windows\TEMP\tmp8359.msi' is not valid. Error: 'Microsoft.ApplicationProxy.Common.Utilities.Certificates.CertificateValidation.CertificateValidationException: ErrorCode: 'InvalidChain' Certificate: 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'F8B9D82E2E34F627E0FDF6739B051553561690E0' Root CA: 'CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'/'8F43288AD272F3103B6FB1428485EA3014C0BCFE' Error: 'Unable to validate certificate chain: ChainElements:

EVENT ID 32002

Failed downloading new Microsoft Azure AD Connect Agent installer. Error: 'System.UnauthorizedAccessException: Access to the path 'C:\Windows\TEMP\tmp8359.msi' is denied.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

at System.IO.File.InternalDelete(String path, Boolean checkHost)

at Microsoft.ApplicationProxy.Common.Utilities.Installation.MsiRunner.Run(Byte[] msiBytes, String[] args, Predicate`1 msiFileValidator)

at Microsoft.Azure.ADConnect.AgentUpdater.Runtime.CheckForUpdateHandler.CheckForUpdate()'.

I confirmed .Net version is correct on the server
Ibrahim Benna 0 Reputation points

2024-10-01T16:10:09.75+00:00

So I have been doing some digging on this issue and noticed that the first certificate in the error ID 32005 wasnt anywhere on the server! I then checked the properties of the file downloaded by the updater in C:\windows\Temp and it has a code signing certificate attached to it -BUT ITS EXPIRED, since April 2024!

Unfortunately, it looks like it has to be a manual install or wait until Microsoft update the signing certificate on the install file.

Answer 1

Yes, You can simply download a newer version and update accordingly. Ensure that the Connect server has sufficient permissions to download updates.

Check the permissions here: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions

You can also check events viewer logs to ensure no error is logged that is preventing the upgrade. See Applications and Services Logs > Microsoft > Entra ID Connect

If the above information was useful, please remember to Mark "Accept Answer" and 'Upvote'

Regards,

Abiola

Answer 2

Daniel Grønnemose 0

I would prefer to keep it on the version already installed, as we have two servers - one for failover and I would need to upgrade both then, to ensure equal versions.

Answer 3

Ibrahim Benna 0

I have been doing some research on this issue and came across this. I was not able to find the first certificate in the error ID 32005 anywhere on the server. I then checked the properties of the installer file downloaded by the updater in c:\windows\Temp and found it has a code signing certificate associated with it - BUT ITS EXPIRED since April 2024!

Unfortunately, it seems that it has to be a manual upgrade until Microsoft resolves the certificate issue

AAD

Share via

AD Connect Sync not autoupdating

3 answers

Your answer