KnowledgeBase: You receive “the mS-DS-ConsistencyGuid attribute is already in use” when you change the source anchor on a Staging Mode Azure AD Connect installation

Azure AD Connect

In environments with multiple Azure AD Connect installations, sometimes, you experience unexpected behavior. For instance, when you want to change the source anchor from objectGUID to mS-DS-ConsistencyGuid for your Hybrid Identity implementation.

The situation

An organization leverages multiple Azure AD Connect installations. One installation is the actively synchronizing Azure AD Connect installation, the other installations are Staging Mode installations. Only the actively synchronizing installation performs exports to the connected Active Directory and Azure AD directories.

All Azure AD Connect installations were initially configured with the objectGUID attribute as the source anchor. The source anchor was not migrated to the mS-DS-ConsistencyGuid attribute till date.

The issue

Changing the source anchor requires running the Configure Source Anchor task in an Azure AD Connect installation. Then, you need to make the same changes on the Staging Mode servers as well.

However, when running the Configure Source Anchor task on the (first) Azure AD Connect Staging Mode server, you receive the following error:

"Your source anchor configuration cannot be changed because the mS-DS-ConsistencyGuid attribute is already in use" error on an Azure AD Connect Staging Mode server (click for original screenshot)

The cause

The error is caused, because Azure AD Connect checks the contents of the mS-DS-ConsistencyGuid attribute of objects in scope to see if no other application, system or service uses the attribute. Overwriting these values could potentially be catastrophic for these solutions.

The solution

The actively synchronizing Azure AD Connect installation is the service that writes values in the mS-DS-ConsistencyGuid attribute. As a Staging Mode Azure AD Connect installation doesn’t perform export actions, it does not actually write to the mS-DS-ConsistencyGuid attribute.  Therefore, the issue can be safely ignored, and Azure AD Connect can be instructed to do so.

On the Staging Mode server(s) we need to start Azure AD Connect differently. Instead of starting AzureADConnect.exe from the Desktop or Start Screen, we need to start it from an elevated Command Prompt window with the following two commands:

cd C:\Program Files\Microsoft Azure Active Directory Connect

AzureADConnect.exe /SkipLdapSearch

Then, we can run the Configure Source Anchor task without the error.

Concluding

A Staging Mode server checks the contents of the mS-DS-ConsistencyGuid attribute, as it has no knowledge of any actively synchronizing Azure AD Connect installation. This information is not provided from the endpoints that Azure AD Connect communicates with, although they could…

Further reading

Using ms-DS-ConsistencyGuid as sourceAnchor
Explained: User Hard Matching and Soft Matching in Azure AD Connect  
Azure AD Connect: objectGUID vs. mS-DS-ConsistencyGuid, Part 1    
Azure AD Connect: objectGUID vs. mS-DS-ConsistencyGuid, Part 2    
Azure AD Connect: objectGUID vs. mS-DS-ConsistencyGuid, Part 3  
Azure AD Connect v1.5.18.0 brings mS-DS-ConsistencyGUID as source anchor for Groups

leave your comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.