We are getting below error while running active directory import in sharepoint 2016 for user profile synchronization.

Error="ActiveDirectory Import: DirSync import failed: ScanDirSyncChanges: Exception thrown by Dirsync request: page 0, LdapServer 'X.XXX.net', rootDn 'DC=XXX,DC=net', exception 'System.DirectoryServices.Protocols.DirectoryOperationException: The user has insufficient access rights. "

We are able to pouplate domain controller .

2 Answers 2


from the error, its look like your account dont have Replicating Directory Permissions on the domains which you trying to sync.

Check this harber post,which shows the same error without Replicating permission.http://www.harbar.net/archive/2012/07/23/sp13adi.aspx

Follow this technet article to set the permission properly.

  • To grant Replicate Directory Changes permission on a domain
  • On the domain controller, click Start, click Administrative Tools, and then click Active Directory Users and Computers.
  • In Active Directory Users and Computers, right-click the domain, and then click Delegate Control.
  • On the first page of the Delegation of Control Wizard, click Next.
  • On the Users or Groups page, click Add.
  • Type the name of the synchronization account, and then click OK.
  • Click Next.
  • On the Tasks to Delegate page, select Create a custom task to delegate, and then click Next.
  • On the Active Directory Object Type page, select This folder, existing objects in this folder, and creation of new objects in this folder, and then click Next.
  • On the Permissions page, in the Permissions box, select Replicating Directory Changes (select Replicate Directory Changes on Windows Server 2003), and then click Next.
  • Click Finish.
  • Thanks Waqas for input.I am able to do Profile synchronization with same profile account in SP2010,although i have separate profile account in SP2010.I did this just to know whether it has sufficient active directory replication changes access or not.Any idea on this error? Jan 19, 2017 at 7:39

Have you create connection for active directory user sync?

If yes, then from which user account you can enter in connection and please check whatever user you can use in connection is having proper permission in active directory or not?

  • Yes i am able to create connection and also getting all the container from our forest. Jan 19, 2017 at 7:40
  • Please check logs in below location whether there is any error while synchronization runnig. C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe Please also check User profile synchronization service running under Manage services on server section in Central Administrator. Jan 19, 2017 at 9:02
  • i think you have mistaken SP2016 as SP2010.As there is no profile synchronization service in SP2016.The error which has been posted here have taken from ULS Only Jan 19, 2017 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.