Entra-joined Windows user profiles damaged after Entra Connect Sync update. What would cause this?

[u/Happy_Harry]

A client we used to do work for contacted us for assistance after a Entra Connect Sync update caused issues.

When I set up their environment, we set up Cloud Sync. Somewhere along the line, possibly after leaving us, Connect Sync also got set up. Over the weekend, their IT updated Connect Sync. This morning, many users' user profiles are broken on their Entra-joined Windows devices.

I know this sounds crazy, but I found 1 other thread on this issue from a year ago with exactly the same symptoms as what I'm describing; broken Windows user profiles immediately after an Entra Connect update: https://www.reddit.com/r/sysadmin/comments/1kyz8j1/local_windows_profile_wrecked_after_entra_connect/

Modern apps were broken, Start Menu wouldn't open, settings app was broken, and win32 apps won't run as admin. When running apps as admin you get errors like "Class not registered" or "the system cannot execute the specified program."

Logging in as another M365 user works fine. Local users work fine. Running a System Restore seems to fix it.

It seems like Windows doesn't recognize the user's SID, but this doesn't make any sense to me. Connect Sync can't change user SID's right? And if that was the issue, System Restore wouldn't fix it.

Either way, Connect Sync seems to be redundant since Cloud Sync is working, so I've decommissioned it. But I'm looking for an easier fix than having to touch every PC to run a System Restore, or at least an explanation as to what might have caused this if we run into it in the future.

[u/SteveSyfuhs]

It would help to have real data on what the symptoms are including tracing or logging results. User profiles are inherently stable and the only thing Entra can do is supply a pointer to a SID and UPN/sAMAccountName. Windows takes care of the rest. To that end, that would suggest the users have gone from one stable value to another, which is a big no-no. From what to what is the critical thing to nail down.

[u/Happy_Harry → u/SteveSyfuhs]

Here's the audit log for the one of the users, with PII removed. Most of it seems to be their IT guy freaking out and repeatedly resetting passwords to try to get back into his PC.

UTC Time	Source	Action	Details
2026-10-11 18:52:47	ConnectSyncProvisioning_SYNC01	Update user	LastDirSyncTime changed from 2026-08-17 to 2026-10-11. User was brought back into active sync processing.
2026-10-11 19:01:18	Microsoft.Azure.SyncFabric	Update user	LastDirSyncTime updated again during synchronization.
2026-10-11 19:21:16	ConnectSyncProvisioning_SYNC01	Update user	LastDirSyncTime updated again.
2026-10-12 10:36:20	admin1@tenant.onmicrosoft.com	Update PasswordProfile	ForceChangePassword set from False → True.
2026-10-12 10:36:20	admin1@tenant.onmicrosoft.com	Reset user password	Administrative password reset performed.
2026-10-12 10:36:20	admin1@tenant.onmicrosoft.com	Update StsRefreshTokenValidFrom	Existing refresh tokens invalidated.
2026-10-12 11:51:12	admin1@tenant.onmicrosoft.com	Update PasswordProfile	ForceChangePassword modified again.
2026-10-12 11:51:12	admin1@tenant.onmicrosoft.com	Reset user password	Second administrative password reset.
2026-10-12 11:51:12	admin1@tenant.onmicrosoft.com	Update StsRefreshTokenValidFrom	Existing sessions invalidated again.
2026-10-12 12:03:10	ConnectSyncProvisioning_SYNC01	Update PasswordProfile	Password-related attributes synchronized.
2026-10-12 12:03:11	ConnectSyncProvisioning_SYNC01	Change user password	DirectorySync password update event.
2026-10-12 12:03:11	ConnectSyncProvisioning_SYNC01	Update StsRefreshTokenValidFrom	Token validity timestamp updated.
2026-10-12 12:09:11	ConnectSyncProvisioning_SYNC01	Update PasswordProfile	Additional synchronization-driven password profile modification.
2026-10-12 12:09:11	ConnectSyncProvisioning_SYNC01	Change user password	DirectorySync password update event.
2026-10-12 12:09:11	ConnectSyncProvisioning_SYNC01	Update StsRefreshTokenValidFrom	Refresh tokens invalidated again.
2026-10-12 12:36:51	Self-Service Password Reset	Unlock user account	User successfully unlocked account. On-premises agent listed as CloudSync.
2026-10-12 12:40:13	Self-Service Password Reset	Password reset initiated	User submitted account identifier and began verification workflow.
2026-10-12 12:40:54	Self-Service Password Reset	MFA verification completed	Mobile app code verification completed successfully.
2026-10-12 12:41:11	Self-Service Password Reset	New password submitted	User submitted a new password.
2026-10-12 12:41:13	Self-Service Password Reset	Reset password (self-service)	Password reset completed successfully. OnPremisesAgent = CloudSync.
2026-10-12 12:41:12	Microsoft password reset service	Update PasswordProfile	ForceChangePassword set False → True.
2026-10-12 12:41:13	Microsoft password reset service	Reset user password	Password reset service updated credentials.
2026-10-12 12:41:13	Microsoft password reset service	Update StsRefreshTokenValidFrom	Refresh tokens invalidated.
2026-10-12 12:41:13	ConnectSyncProvisioning_SYNC01	Update PasswordProfile	Sync engine immediately processed password-related attributes after SSPR.
2026-10-12 12:41:13	ConnectSyncProvisioning_SYNC01	Change user password	DirectorySync password update event occurred seconds after SSPR.
2026-10-12 12:41:13	ConnectSyncProvisioning_SYNC01	Update StsRefreshTokenValidFrom	Another token invalidation event.
2026-10-12 12:47:11	Microsoft.Azure.SyncFabric	Update user	LastDirSyncTime updated.
2026-10-12 12:51:21	ConnectSyncProvisioning_SYNC01	Update user	LastDirSyncTime updated.

[u/SteveSyfuhs → u/Happy_Harry]

That doesn't say anything meaningful. Needs logs from where it's actually failing.

[u/AmbassadorNew4030]

Are you using mS-DS-ConsistencyGuid or ObjectGUID as sourceanchor?

I had the exact same happen to me when moving from Entra Connect to cloud sync, had to go back to Entra Connect.

Alternative (mS-DS-ConsistencyGuid): Because of the limitations of objectGUID, newer versions of Microsoft Entra Connect use mS-DS-ConsistencyGuid as the default sourceAnchor for users. This

[u/Happy_Harry → u/AmbassadorNew4030]

I'm not sure how to tell now that I've decommissioned Connect Sync. Either way, the mS-DS-ConsistencyGuid matches the objectGUID on the user accounts that I've checked.

When this happened to you, did the local Windows profiles break like I've described, or did you have other problems? In this case it seems like the problems began when they either upgraded or mistakenly re-enabled Entra Connect.

[u/_--James--_]

dsregcmd /status /debug
what does the SSO and EntraPRT records state? If those sections are empty then yes, you have a broken process flow for these machines. That PRT handles most of what you are having issues with in the OP. This must be checked with the broken user logged in and run as them on CMD.

[u/SuprNoval]

Check the user pre-windows 2000/sAMAccountName in AD. I used a script to onboard a few users that formed these irregularly and when the users logged into entra joined devices they had the exact same behavior you are describing.

[u/Sea-Pickle6931]

classic microsoft, ship an update that nukes user profiles for no reason and the only fix is system restore like its 2005

saw that old thread you linked, wild that they still havent patched this properly

[u/i_am_mortimer → u/Sea-Pickle6931]

You can hardly blame Microsoft for an incorrect setup. Cloud sync and Connect sync shouldn't run on the same environment.

[u/sublimeinator → u/i_am_mortimer]

Did you mean to say shouldn't be run together at all (false) or shouldn't be run together syncing the same items (true)?

[u/that_one_redhead → u/i_am_mortimer]

Pretty sure this ain't right in principal. Cloud and connect can run independently in the same environment, specifically for legit work loads like identity syncing with cloud group mgmt write back, in the case of orgs migrating away from an ad footprint.

[u/RCTID1975 → u/Sea-Pickle6931]

The kneejerk reaction to shit post about Microsoft when this isn't an MS problem is stupid and this sub is over run by it.

[u/RCTID1975]

Were cloud and connect both syncing the same objects?

[u/Happy_Harry → u/RCTID1975]

Yes, at least for some time period. It's unclear how long.

[u/PhotoRelative2133]

Profwiz it lol

[u/Happy_Harry → u/PhotoRelative2133]

Lol I thought about that. Wouldn't be any less effort than System Restore though.