AaronA.97300 (Teaching Strategies, LLC) asked a question.
AD Agent "not a member of the Domain Admins Group" Error
Over the weekend we started to see users having trouble with password resets - they'd receive an error that their "password could not be changed. Please contact your administrator." After some troubleshooting I determined that the agents seemed unable to write back the password changes to AD. I filed a ticket with Okta yesterday, as my troubleshooting wasn't producing results.
As of this morning, all of our AD Agents are reporting that the OktaService "account is not a member of the domain admins group". Nothing has changed about this account in almost 2 years; it's a member of Domain Admins, and has delegated permissions to the domain, as indicated in AD Agent Prerequisites: https://help.okta.com/en/prod/Content/Topics/Directory/ad-agent-prerequisites.htm.
Furthermore, I attempted to create a new service account, following the procedure, but got the same result: "account is not a member of the domain admins group".
I am at a loss. Any assistance/hints/tips would be appreciated.
Hello @AaronA.97300 (Teaching Strategies, LLC)
I noticed you have an open case on this issue. Was the Okta support team able to help you with this?
Regards,
Natalia
Okta Inc.
They're in the preliminary stages of trying to assist. Nothing fixed yet.