Failed to synchronize LDAP2022/LDAP2025 when FIPS mode is enabled

Last Updated : Sep 24, 2026 |
Prolog information
Metadata
Keywords:

Condition

Failed to synchronize LDAP2022/LDAP2025 on the GUI when using secure LDAP (LDAPS) with FIPS mode enabled.

Cause

The cipher mismatch between LDAP2022/LDAP2025 and AADS server.

Solution

  1. Disable TLS 1.3 on LDAP AD2025 server.
  2. Login to the LDAP AD2025 server.
  3. Open Windows Powershell as an administrator.
  4. Run the following command to check if TLS 1.3 is available:
    ADDITIONAL INFORMATION:
    reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server
    For examle
    PS C:\WINDOWS\system32> reg query  HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server
        Enabled    REG_DWORD    0x1
  5. Add TLS 1.3 entry with disabled to the registry, if the query returns nothing. Run the following command:
    ADDITIONAL INFORMATION:
    reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server" /v Enabled /t REG_DWORD /d 0 /f
  6. Run thereg query command to verify that the value is set correctly.
    ADDITIONAL INFORMATION: PS C:\WINDOWS\system32> reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server
        Enabled    REG_DWORD    0x0
  7. Restart LDAP AD2025 service using the following command:
    ADDITIONAL INFORMATION:
    Restart-Service NTDS -Force -ErrorAction Stop