Active Directory Synchronization Bug and Fix

Active Directory Synchronization Bug – September 2025

• Affected Systems:
  Windows Server 2025 machines with KB5065426 or later updates installed.

• Issue:
  Applications using the DirSync control (e.g., Microsoft Entra Connect Sync) fail to fully synchronize large AD security groups (groups with over 10,000 members).

• Impact:

  • Incomplete synchronization of large groups
  • Disruption in identity and access management
  • Potential issues in hybrid cloud environments relying on accurate group membership

• Mitigation:

  • Microsoft has released a temporary registry workaround
• A permanent fix is expected in a future Windows update
  
  
  

  Here is the PowerShell script that:

  • Checks if KB5065426 or later is installed
  • Applies the registry workaround to mitigate the DirSync bug affecting large AD security groups
  
  

  What the Script Does:

  1. Searches for installed hotfixes matching KB5065xxx.
  2. If found, it sets the registry key:

     HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\UseLegacyGroupEvaluation = 1
     

  3. This enables legacy group evaluation to restore proper synchronization behavior.
     
     
     

  
# Check if the KB5065426 or later is installed
$hotfixes = Get-HotFix | Where-Object { $_.HotFixID -match "^KB5065\d{3}$" }

if ($hotfixes) {
    Write-Output "KB5065426 or a later update is installed. Applying registry workaround..."

    # Define the registry path and values
    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters"
    $name = "UseLegacyGroupEvaluation"
    $value = 1

    # Create the registry key if it doesn't exist
    if (-not (Test-Path $regPath)) {
        New-Item -Path $regPath -Force | Out-Null
    }

    # Set the registry value
    New-ItemProperty -Path $regPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null

    Write-Output "Registry workaround applied successfully."
} else {
    Write-Output "KB5065426 or later update is not installed. No action taken."
}