LDAP Error Code 53 - Unwilling To Perform: ADS Account Creation Failure

Products

• CA Identity Suite
• CA Identity Manager
• CA Identity Portal
• CA Identity Governance

Issue/Introduction

Identity Manager users may encounter search or account creation failures when interacting with Active Directory (ADS). This issue typically manifests during the creation of a new ADS account, even if modifications to existing accounts remain functional.

Environment

Identity Manager

Cause

Microsoft/ADS Issue: The Domain Controller (DC) account-identifier allocator (RID Master) fails to initialize, preventing the assignment of new SIDs.

When try to create a new ADS account we can see the error message in the Event Viewer (System)

"The account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure. Windows will retry the initialization until it succeeds; until that time, account creation will be denied on this Domain Controller. Look for other SAM event logs that may indicate the exact reason for the failure."

Resolution

Domain Controller Review:

• • Contact your Microsoft/ADS support team to resolve the RID Master initialization failure.
  • Refer to Microsoft documentation for Event ID 16650.

Additional Information

If the information above is not your case, please, see the KB article:

LDAP: error code 53 - Unwilling To Perform