What you’re seeing
- The Microsoft password reset page shows SSPR_0029 or says it can't reset the password due to an on-premises configuration error.
- An error such as 'OnPremisesUserNotFound' appears in the audit log after a reset attempt.
- The reset appears to succeed, but the old password still works on office PCs and the VPN.
- Users end up with one password for Microsoft 365 and a different one for Windows sign-in.
- Only certain users hit the failure, often those in a specific OU or admin group.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Password writeback was never enabled in Entra Connect, or it got switched off during an upgrade.
- The Entra Connect service account lacks permission to reset passwords on those AD accounts.
- The affected users are protected admin accounts that block delegated password changes.
- A Group Policy password rule on-premises rejects the new password even though the cloud accepted it.
- The Entra Connect server can't reach Microsoft's writeback service because of a firewall or proxy.
Why it matters
Self-service reset is supposed to cut helpdesk calls, but when writeback fails, it creates more confusion than it solves. Staff end up with mismatched passwords, get locked out of their PCs or VPN, and call for help anyway. Remote workers can be left unable to work until someone resets their password manually. The mismatch also leads people to write passwords down or reuse simple ones, which weakens security across the business.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Why does the reset work for some people and not others?
Permissions in Active Directory often differ between users. Accounts that were once admins, or that live in certain folders, may block the sync service from changing their passwords.
Is password writeback secure?
Yes, when set up properly it uses an encrypted connection between Microsoft and your sync server. The key is giving the sync account just the permissions it needs.
How does AskTechGurus help?
A certified US engineer reviews your writeback setup over a secure remote session and gets resets flowing to Active Directory again. Pricing starts at $99, and you pay only when it's resolved.