Some user passwords aren't syncing

1. Locate an instance of a password change in AD that was not synced to Google.
2. Make sure the user has not altered their AD password since the first change. 
3. Take note of the exact time the password was changed in AD, the username, and the user's email address.

Verify that the timestamp for the attribute matches the time when the user changed their password.

1. Use AD admin tools, such as ADSIEdit or LDIFDE, to find and copy the pwdLastSet attribute for the user. The attribute's value is the number of 100 nanosecond intervals since January 1, 1601 (UTC). For details about the attribute, go to Pwd-Last-Set attribute.
2. Go to Google Admin Toolbox Encode/Decode.
3. Select pwdLastSet/FILETIME Decode.
4. For Paste the text to encode/decode below, paste the numeric attribute from AD and click Submit.

   The toolbox displays the decoded time value in your local time zone and UTC.

5. If the timestamp doesn't match the time when the user's password was changed, AD didn't process the password update. Resolve the password issues in AD and try again.

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Reporting > Audit and investigation > Admin log events.

   Requires having the Reports administrator privilege.

3. Search for password change events for the user to confirm whether there was a password change within 1–2 minutes of the timestamp in the pwdLastSet attribute. Remember to take time zone differences into account. For details about log events, go to Admin log events.
4. If you verify a password change event in the log events at the correct time, check the following points:
   1. Check that the admin who changed the password matches the admin who authorized Password Sync in the logs. If the admin is the same, Password Sync is working as expected.
   2. Check whether other sources changed the Google user's password after it was synced (causing the password to go out of sync with AD). Resolve the issue before trying again.

To create the report, you need to collect Password Sync logs and details from all writable domain controllers into a single folder. To do so, complete the steps in Option 1: Automatic troubleshooting. 

1. Open a command prompt and use the cd command to navigate to the directory where you created the report in the previous step.

   Example: cd C:\Users\yourname\Desktop\PasswordSyncSupportTool_20240717_142555

2. To search for the username in AD, use the findstr command.

   For examples, go to Examples: Using the finstr command (later on this page).

3. If you find multiple log files with the username, select the file where the log timestamp matches the time in the pwdLastSet attribute. Remember to take the time zone differences into account.
4. In the log, check the lines that mention the username to find an associated error message or code.

   For additional help with errors, go to Password Sync error codes & messages.

5. If you don't find the username, make sure you installed Password Sync on all writable domain controllers. For details go to Ensure that Password Sync is installed correctly (earlier on this page).

6. If you're still experiencing issues, contact Google Workspace support. Provide the following information:
   • Password Sync Support Tool report zip file
   • Email address of the user and the time when their password changed
   • An LDAP Data Interchange Format (LDIF) dump of the user

   For details on how to get in touch with support, go to Contact Google Workspace support.

Examples: Using the findstr command

Example 1: The following command searches for log files in the current directory and its subdirectories that contain the username (case doesn't matter). In the command prompt window, you can review the file name of the matching log files.

findstr /S /I /M /C:"username" *.log

Example 2: The following command searches for log files in the current directory and its subdirectories that contain the username (case doesn't matter). In the command prompt window, you can review the file name of the matching log files and the line number that contains the username.

findstr /S /I /N /C:"username" *.log