Home account errors sync problems troubleshooting windows 10

Windows 10 Sync Error: Account Disabled? Troubleshooting Steps Inside!

Updated: • 0 • min read
Table of Contents

Windows 10 Sync Error: Account Disabled? Troubleshooting Steps Inside!

Windows 10 offers a seamless experience for users by allowing their settings to roam across different devices. This functionality, known as Enterprise State Roaming (ESR), is a powerful feature within Microsoft Entra ID (formerly Azure Active Directory) that enhances productivity and user satisfaction. However, users occasionally encounter issues where these critical settings, such as desktop backgrounds or taskbar positions, fail to synchronize between their devices. When this occurs, it can lead to a fragmented user experience and requires immediate attention to restore the expected functionality.

This article delves into a specific synchronization error where settings fail to sync on Windows 10 clients running various versions, including 1803, 1709, 1703, 1511, and 1607. The core of this problem is often linked to a particular error message indicating an account disability. Understanding the symptoms, underlying cause, and the detailed resolution steps is crucial for IT professionals and system administrators managing Windows 10 environments within an organizational context.

Symptoms of Failed Windows 10 Settings Sync

When Enterprise State Roaming is enabled and configured for Windows 10 clients, the expectation is that supported user settings will automatically synchronize. If synchronization is not occurring, users may notice that their personalized desktop background, saved Wi-Fi networks, installed applications, or taskbar configurations do not follow them from one device to another. This inconsistency can be a significant inconvenience, forcing users to reconfigure their environment on each new or different device they use.

Beyond the visible lack of synchronization, the system logs provide a more technical indication of the problem. Specifically, Event ID 6065 is logged within the Microsoft-Windows-SettingSync/Debug event log. This event is accompanied by an error description: “Event ID 6065:80070533 This user can’t sign in because this account is currently disabled.” The error message clearly points to an account-related issue, even though the user’s primary Microsoft Entra account might appear active and fully functional for other services. This particular event log entry is critical for diagnosing the precise nature of the sync failure.

Example Event Log Entry:

Log Name: Microsoft-Windows-SettingSync/Debug
Source: Microsoft-Windows-SettingSync
Date: <date and time>
Event ID: 6065
Task Category: None
Level: Error
Keywords: User: <User SID>
Computer: WIN10DESKTOP
Description: shell\roaming\cloudsync\cloudsyncengine\cloudsyncengine.cpp(990)\SettingSyncHost.exe!00007FF701A2A8C2: (caller: 00007FF701A2A3D9) ReturnHr[PreRelease](17) tid(1060) 80070533 This user can't sign in because this account is currently disabled. CallContext:[\\AttemptSyncActivity]

This detailed log entry specifies the module and function where the error occurred (SettingSyncHost.exe), the error code (80070533), and the descriptive message. Understanding this output is the first step towards effectively troubleshooting the synchronization problem. It confirms that the system is attempting to sync settings but is being explicitly blocked due to what it perceives as a disabled account, despite the account appearing active for other services.

Unpacking the Cause: The Missing RMSBASIC Subscription

The root cause of this particular Windows 10 sync error, manifesting as Event ID 6065 with the “account disabled” message, lies in the tenant’s provisioning status. Specifically, the Microsoft Entra tenant has not been adequately provisioned with the RMSBASIC subscription. This subscription is not merely an optional add-on; it plays a critical role in the security and functionality of Enterprise State Roaming. RMSBASIC is essential for encrypting the synchronized data, ensuring that user settings remain secure as they traverse between devices and the cloud.

When Enterprise State Roaming is enabled in the Microsoft Entra admin center, the provisioning of the RMSBASIC subscription is expected to happen automatically. However, a common configuration setting can impede this automatic provisioning process: if AllowAdHocSubscriptions is set to False on the tenant, it can prevent the necessary RMSBASIC subscription from being provisioned. This setting is typically configured by administrators to control the types of subscriptions users can self-service within the organization. While well-intentioned for governance, it can inadvertently block essential background services like the RMSBASIC provisioning required for Enterprise State Roaming to function correctly.

In essence, the system attempts to encrypt and synchronize settings but finds the required encryption capability (provided by RMSBASIC) absent. This leads to the “account disabled” error, as the service cannot securely proceed with the sync operation for the user. Therefore, addressing this underlying subscription and tenant configuration is paramount to resolving the synchronization issues.

The Role of RMSBASIC in Enterprise State Roaming

The RMSBASIC subscription is closely tied to Azure Rights Management (Azure RMS) capabilities. While it might sound like a separate security product, for Enterprise State Roaming, it provides the fundamental data protection layer. When user settings are synchronized to Microsoft’s cloud, they are encrypted at rest and in transit. This encryption ensures the confidentiality and integrity of sensitive user data, protecting it from unauthorized access.

Without RMSBASIC, the mechanism for this encryption is incomplete or non-existent within the tenant’s configuration. The Enterprise State Roaming service, designed with security in mind, will consequently halt synchronization attempts. It perceives the lack of proper encryption capability as a critical security vulnerability, interpreting it as an inability to process the user’s data securely, thus leading to the “account disabled” error for the sync operation itself. This highlights the intricate dependency between licensing, tenant configuration, and the seamless functioning of cloud services like Enterprise State Roaming.

Comprehensive Resolution Steps

Resolving the “account disabled” sync error involves a multi-step process focused on verifying and correcting the tenant’s subscription and configuration settings. These steps utilize PowerShell cmdlets to interact with Microsoft Entra ID, ensuring the necessary RMSBASIC subscription is active and that AllowAdHocSubscriptions is appropriately configured to facilitate its provisioning.

Step 1: Verify RMSBASIC Subscription Status on the Tenant

The initial step is to confirm whether the RMSBASIC subscription is already present and active within your Microsoft Entra tenant. This can be done efficiently using PowerShell.

  1. Open PowerShell and Connect to Microsoft Entra ID:
    Launch PowerShell with administrative privileges. You will need to sign in to Microsoft Entra ID using your administrative credentials. Execute the following commands:

    $msolcred = get-credential
connect-msolservice -credential $msolcred

    The first line will prompt you to enter your Microsoft Entra administrator username and password. The second line establishes a secure connection to your Microsoft Entra tenant using these credentials. Ensure you have the necessary permissions to query subscription information.

  2. Run Cmdlet to View SKUs:
    Once connected, execute the following cmdlet to retrieve a list of all active Stock Keeping Units (SKUs) associated with your organization’s tenant:

    Get-MsolAccountSku

    This command provides a comprehensive overview of all licenses and subscriptions currently provisioned for your tenant. The output will display various AccountSkuId values, along with details like ActiveUnits, WarningUnits, and ConsumedUnits.

  3. Check for RMSBASIC:
    Carefully review the output from Get-MsolAccountSku. Look for an entry where the AccountSkuId explicitly lists tenantname:RMSBASIC.

    Example Output (RMSBASIC Present):

    AccountSkuId               ActiveUnits WarningUnits ConsumedUnits
---------------            ------------ -------------- -----------------
tenantname:ENTERPRISEPACK  25           0              14
tenantname:INTUNE_A        25           0              23
tenantname:AAD_PREMIUM     100          0              21
tenantname:RIGHTSMANAGEMENT_ADHOC 1000         0              18
tenantname:RMSBASIC        1000         0              18

    If tenantname:RMSBASIC is listed in your output, it indicates that the RMSBASIC subscription is already provisioned. In this scenario, the root cause described in this article does not apply, and you do not need to proceed with the remaining steps of this resolution guide. You might need to investigate other potential causes for the sync failure.

    Example Output (RMSBASIC Not Present):

    AccountSkuId               ActiveUnits WarningUnits ConsumedUnits
---------------            ------------ -------------- -----------------
tenantname:ENTERPRISEPACK  25           0              14
tenantname:INTUNE_A        25           0              23
tenantname:AAD_PREMIUM     100          0              21
tenantname:RIGHTSMANAGEMENT_ADHOC 1000         0              18

    If tenantname:RMSBASIC is not present in the Get-MsolAccountSku output, this confirms that the RMSBASIC subscription is missing. You should then proceed to the next step to investigate and modify the AllowAdHocSubscriptions setting.

Step 2: Verify and Adjust AllowAdHocSubscriptions Setting

If RMSBASIC was not found in the previous step, the next logical step is to check the AllowAdHocSubscriptions setting on your tenant. This setting can block the automatic provisioning of necessary subscriptions.

  1. Open PowerShell and Connect to Microsoft Entra ID:
    Similar to Step 1, ensure you have an active PowerShell session connected to Microsoft Entra ID with administrative credentials. If your previous session timed out or was closed, re-establish the connection using:

    $msolcred = get-credential
connect-msolservice -credential $msolcred

  2. Determine AllowAdHocSubscriptions Status:
    Execute the following cmdlet to check the current value of AllowAdHocSubscriptions for your tenant:

    Get-MsolCompanyInformation | fl AllowAdHocSubscriptions

    This command retrieves company-specific information and filters it to display only the AllowAdHocSubscriptions property. The output will show either True or False.

  3. Enable AllowAdHocSubscriptions (If Necessary):
    If the command returns AllowAdHocSubscriptions : False, this is likely preventing the RMSBASIC subscription from being provisioned. To temporarily enable it, run the following command:

    Set-MsolCompanySettings -AllowAdHocSubscriptions $true

    This command modifies your tenant’s settings to allow ad-hoc subscriptions. While this setting is typically managed for broader organizational policies, enabling it temporarily is crucial for provisioning RMSBASIC. You can revert it later if your organizational policy requires it to be False. If the command returned AllowAdHocSubscriptions : True, you still need to proceed to the next verification step, as there might be a timing issue or another factor preventing RMSBASIC provisioning.

Step 3: Disable and Re-enable Enterprise State Roaming

After potentially enabling AllowAdHocSubscriptions, it’s necessary to prompt the system to re-evaluate and provision the RMSBASIC subscription. The most effective way to do this is by toggling the Enterprise State Roaming setting in the Microsoft Entra admin center.

  1. Navigate to Microsoft Entra Admin Center:
    Open a web browser and sign in to the Microsoft Entra admin center using an account with Global Administrator or Hybrid Identity Administrator roles.

  2. Access Enterprise State Roaming Settings:
    In the left-hand navigation pane, go to Identity > Users > User settings.
    Scroll down to the Enterprise State Roaming section.

  3. Toggle Enterprise State Roaming:
    Locate the setting “Users may sync settings and enterprise app data”.
    If it’s set to All or Selected, first change it to None. Click Save.
    After saving, wait a moment (e.g., 30 seconds).
    Then, change the setting back to its original configuration (either All or Selected, with the appropriate group selected if applicable). Click Save again.

    This process essentially “refreshes” the Enterprise State Roaming configuration for your tenant, prompting Microsoft Entra ID to re-evaluate the necessary backend services and hopefully provision the RMSBASIC subscription. This step is critical for ensuring the changes made in PowerShell are recognized and acted upon by the service.

Step 4: Verify RMSBASIC Subscription After Toggle

Once you have toggled the Enterprise State Roaming setting, it’s time to re-check if the RMSBASIC subscription has been successfully provisioned.

  1. Re-run Get-MsolAccountSku:
    Return to your PowerShell session and execute the Get-MsolAccountSku cmdlet once more:

    Get-MsolAccountSku

    Observe the output carefully. You should now see tenantname:RMSBASIC listed among your active subscriptions. If it appears, the provisioning was successful, and your Windows 10 sync issues related to this cause should be resolved.

    If, after these steps, RMSBASIC is still not listed, there might be a propagation delay, or another underlying issue might be at play. Consider waiting a few hours and re-checking, or contacting Microsoft Support if the issue persists.

Optional Step: Revert AllowAdHocSubscriptions to False

If your organization’s policy mandates that AllowAdHocSubscriptions be set to False, you can revert this setting after confirming that the RMSBASIC subscription has been successfully provisioned.

  1. Execute Cmdlet to Disable Ad-Hoc Subscriptions:
    In your PowerShell session, run the following command:

    Set-MsolCompanySettings -AllowAdHocSubscriptions $false

    This will set the AllowAdHocSubscriptions property back to False. It’s generally safe to do this once RMSBASIC is provisioned, as the subscription is typically retained even if new ad-hoc subscriptions are no longer allowed. Confirm with your organizational policies before making this change.

General Best Practices and Troubleshooting Tips for State Roaming

Beyond this specific error, maintaining healthy Enterprise State Roaming requires adherence to several best practices and general troubleshooting awareness.

Ensuring Proper User Licensing

Enterprise State Roaming requires specific Microsoft Entra ID licenses, typically Microsoft Entra ID P1 or P2. Ensure that affected users are assigned the appropriate licenses. Without the correct licensing, even a perfectly configured tenant won’t allow settings to sync for individual users. Regularly audit user license assignments to prevent such issues.

Device Registration Status

For Enterprise State Roaming to function, Windows 10 devices must be registered with Microsoft Entra ID. This can be through Microsoft Entra joined, hybrid Microsoft Entra joined, or Microsoft Entra registered devices. Verify the device’s registration status in the Microsoft Entra admin center (Identity > Devices > All devices). An unregistered or improperly registered device will not be able to sync settings.

Network Connectivity

Reliable network connectivity to Microsoft cloud services is paramount for synchronization. Ensure that devices have consistent internet access and that no firewall rules or proxy settings are inadvertently blocking traffic to Microsoft Entra ID and related services. Intermittent connectivity can lead to sync delays or failures, even if the configuration is correct.

User Group Assignment

If Enterprise State Roaming is configured for “Selected” users, ensure that the problematic user accounts are members of the specified security group. Changes to group memberships might take some time to propagate, so allow for replication delays. Always verify group memberships directly in Microsoft Entra ID.

Understanding Microsoft Entra ID and Msol Cmdlets

The MSOnline PowerShell module, which provides the Msol cmdlets, is essential for managing Microsoft Entra ID. It’s crucial for administrators to be familiar with its capabilities, especially for tasks related to tenant and user management. Cmdlets like Get-MsolAccountSku allow administrators to quickly ascertain the licensing status of their tenant, which can be pivotal in diagnosing service-related issues. Set-MsolCompanySettings, on the other hand, provides granular control over organizational-wide policies, including those that might impact service provisioning. These tools empower IT professionals to maintain a robust and well-configured cloud environment.

Data Protection and Compliance Considerations

The RMSBASIC subscription’s role in encrypting synchronized data underscores Microsoft’s commitment to data security. For organizations operating under strict compliance regulations, understanding that Enterprise State Roaming leverages these encryption capabilities is vital. It ensures that user settings, which might contain personal or organizational preferences, are handled securely, meeting various data protection standards. Administrators should always ensure that these fundamental security components are active and properly configured to maintain compliance and protect user data effectively.

Conclusion

Resolving Windows 10 sync errors, particularly those related to the “account disabled” message for Enterprise State Roaming, often boils down to ensuring the correct backend services and tenant configurations are in place. The missing RMSBASIC subscription, often a consequence of AllowAdHocSubscriptions being set to False, is a common culprit. By systematically verifying the RMSBASIC status, adjusting tenant settings via PowerShell, and refreshing Enterprise State Roaming in the Microsoft Entra admin center, administrators can effectively restore seamless settings synchronization for their users.

The continuous evolution of cloud services and the interplay between various Microsoft Entra ID features necessitate a deep understanding of these dependencies. Proactive monitoring of event logs and regular audits of tenant configurations are key to preventing such issues and ensuring a smooth, productive experience for all users. Staying informed about the latest recommendations for Microsoft Entra ID and related services will always be beneficial for maintaining optimal performance and security.

We hope this detailed guide helps you resolve any Windows 10 sync issues you may encounter. If you’ve experienced this problem or have additional insights or questions, we encourage you to share them in the comments below. Your experiences and solutions can help others in the community!

Post a Comment