No More "Account Disabled" Right After You Get Access ​

October 6, 2026 · GrantFlow Team

You activate a role, open a session to a server, and Windows greets you with "Your account has been disabled". Nothing is wrong with your access. GrantFlow enabled your account and added it to its groups on one domain controller, but Windows checked your logon against another one that had not received the change yet. A few minutes later everything works, but that first impression is the wrong one for a privileged access tool.

GrantFlow now confirms the change on the domain controllers that can check your logon before your session connects.

What Changes for You ​

When you open a session, the preparing steps now include Applying access and waiting for AD replication. GrantFlow brings your change to the domain controllers that serve the target, reads it back from each of them, and connects you once they all have it. With the recommended setup this can take a fraction of a second: in our lab, both domain controllers of a site confirmed in about 0.1 seconds.

If a domain controller cannot confirm the change, for example because it is unreachable or replication is slow, you see a clear warning that names the domain controller and the reason instead of a confusing Windows error. Your access is already applied, so you can choose Connect anyway.

What Changes for Admins ​

Every confirmation shows up as an AD Replication Check job next to the activation's other jobs on the Connector Jobs page, so you can see when a check ran and whether it finished. The AD connector test now also tells you whether your setup can confirm replication quickly, and what to fix if it cannot:

  • Agent version: the check needs AD agents on version 0.4.0 or later. Until you update, sessions open exactly as before, without the check.
  • Replication Synchronization: granting this right to the connector's service account lets GrantFlow ask each domain controller to pull the change immediately. Without it, GrantFlow waits for normal replication, which took about 15 seconds within a site in our lab. The connector card shows the exact command to grant it.
  • Verified TLS: connectors that skip TLS verification cannot confirm replication, and their sessions show a warning. Turn certificate verification on.
  • Reachability: the agent must be able to reach every domain controller it checks. The connector test lists, per site, any it cannot reach.

The check covers Active Directory. Entra ID assignments are not part of it.

Get Started ​

Update your AD agents, run the connector test on each AD connector, and follow any warning it shows. The AD Replication Check guide explains which domain controllers GrantFlow checks, what each warning means, and how to set up targets in other AD sites.