Management Console: Active Directory sync not working due to Disjointed Namespace

Document created by drossler Employee on May 10, 2017Last modified by jyamada on Jun 8, 2017
Version 6Show Document
  • View in full screen mode

When running the AD integration of the Management Console, it's important to understand that changes to the primary DNS suffix will result in a failure to get data from the AD.


The term Disjointed Namespace describes this behavior and means that a computer's primary DNS does not match the DNS name of the Active Directory domain of which the computer is a member. The machine which has a different suffix is called a disjoint.


A typical error message when trying to pull information from the AD would look like below.

Error: System.Exception: Domain account validation failed. Please ensure the user has access to the domain that the server belongs to, and try again


The Malwarebytes Management Console assumes in that example that the namespace is identical to the DNS suffix of the other machines in the domain and fails.


There is currently no solution or workaround for this setup. Only removing the Disjointed Namespace solves possible issues.