FSx for Windows File System Fails to Join On-Prem AD – "Insufficient permissions or connectivity" error during creation

This usually happens because FSx can't reach your on-prem Active Directory during setup. FSx needs network connectivity to your domain controllers and DNS servers to join the domain.

If you don't have a VPN or Direct Connect between your VPC and your local network, FSx simply has no route to your AD - that's why the creation fails with the “insufficient permissions or connectivity” error.

You've got two ways to fix it:

1. Create a VPN or Direct Connect link so FSx can communicate with your AD and DNS.
2. Use AWS Managed Microsoft AD instead. It runs fully inside AWS, and FSx can join it without

network issues. If needed, you can establish a trust with your on-prem AD later.

FSx won't be able to join your on-prem domain without private connectivity. More details in the docs:

• Join FSx to a self-managed AD
• Using FSx with AWS Managed Microsoft AD

The error you're encountering when creating an FSx for Windows File Server is related to Active Directory integration issues. Based on the error message about "insufficient permissions or connectivity to your Active Directory," there are a few key areas to check:

1. Service Account Permissions: The service account you're using likely doesn't have sufficient permissions to join the file system to your domain with the specified organizational unit (OU). Ensure your service account has the required permissions to join computers to the domain and specifically to the OU you've designated.

2. Network Connectivity: Amazon FSx needs to establish a connection with your on-premises Active Directory domain controllers. Without Direct Connect or VPN (which you mentioned you're not using), there may be network connectivity issues preventing this communication.

3. Security Groups and Network ACLs: Check that your VPC security groups and network ACLs allow traffic on the required ports for Active Directory communication.

4. DNS Configuration: Ensure that the DNS server IP addresses you've provided are correct and reachable from your VPC.

To resolve this issue:

• Verify and potentially update the service account permissions in your Active Directory
• Ensure network connectivity between your AWS VPC and on-premises AD environment
• Consider using AWS Directory Service for Microsoft Active Directory instead of directly connecting to your on-premises AD if establishing connectivity is challenging without VPN/Direct Connect

Without a direct network connection between AWS and your on-premises environment, it will be difficult to join FSx to your on-premises AD. You might need to reconsider your architecture, possibly implementing a VPN connection or using AWS Directory Service as an alternative.
Sources
Creating a new Amazon FSx file system fails - Amazon FSx for Windows File Server
Troubleshoot FSx for Windows File Server in a Misconfigured state | AWS re:Post
File system is in a misconfigured state - Amazon FSx for Windows File Server
Working with Microsoft Active Directory - Amazon FSx for Windows File Server