Okta Active Directory Agent Reports Disrupted State and SCAN_ERROR

The Okta Active Directory (AD) agent unexpectedly disconnects and reports a Disrupted state on the Integration Agents page and on the Agents tab for the directory integration. This occurs when the domain controller fails to return a payload within the established timeout window. Restart the Okta AD agent service or reinstall the agent to resolve the error.

SCAN_ERROR

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)

A Disrupted status on the Okta AD agent represents a transient reporting condition rather than an active service outage or agent disconnection. The Okta AD agent maintains a connection to Okta and continues communicating with the domain controllers. Essential identity workflows, including delegated authentication and scheduled user imports, continue to function normally.

The Okta AD agent issues a Lightweight Directory Access Protocol (LDAP) request to query an object update from the target domain controller. If the domain controller fails to return a payload within the established connection or read timeout window of the agent, the AD agent registers a failed operation attempt. Environmental factors that interfere with LDAP requests include momentary domain controller resource throttling, thread saturation, or transient network latency.

Upon recording an unhandled exception or null response from the domain controller query, the Okta AD agent reports an operational fault code back to Okta. Okta then flags the agent status as Disrupted or SCAN_ERROR.

What resolves the Okta AD agent disruption?

Deactivate and reactivate the agent, restart the service, reboot the server, or reinstall the agent to resolve the disruption.

• Navigate to the Agents tab for the directory integration in the Admin Console and choose the option to deactivate, then reactivate the agent.
• Restart the Okta AD agent service from the Services.msc console on the server hosting the disrupted AD agent.
• Reboot the server hosting the disrupted AD agent.
• Reinstall the Okta AD agent over the existing installation to bring the agent back online.

The Windows Event logs contain possible root causes.

Review the local Windows Event logs and contact Okta Support to identify the environmental factors that caused the disruption.

• Review the Windows Logs and the local Windows Event Logs (Directory Services and System logs) for any LDAP latency spikes, RPC timeouts, or Kerberos ticket processing delays.
• Contact Okta Support to identify the exact time the AD agent entered the Disrupted state.