0

I'm looking for an official list of LDAP error codes

Specifically given LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 531, v1db1

I'm looking for the data-code, in this case 531 = not permitted to logon at this workstation as found by the JIRA LDAP Error Code Documentation.

1
  • 1
    I might start by contacting Microsoft or technet.
    – mdpc
    Oct 15, 2014 at 2:25

3 Answers 3

1

Microsoft makes a program named err.exe that you can download and use to look up error codes. More officially named the Microsoft Error Lookup Tool:

Use the Error Code Lookup tool to determine error values from decimal and hexadecimal error codes in Microsoft Windows® operating systems. The tool can look up one or more values at a time. All values on the command line will be looked up and presented to you. If available, informational data associated with the value or values will also be shown.

It provides error codes for Windows, SQL, Exchange, etc., etc.

There are also online implementations of it (such as http://errlookup.azurewebsites.net) in case you don't want to download the utility, or you want to do a lookup on a non-Windows device.

For example, looking up error code "49" returns a list that includes one for the winldap.h:

LDAP_INVALID_CREDENTIALS winldap.h

So in the winldap context, error 49 is an 'invalid credentials' error.

Looking up error 0x80090308 reports:

  SEC_E_INVALID_TOKEN                                          winerror.h    
# The token supplied to the function is invalid

Which, judging by the SEC_E, again points to an invalid security credential being passed.

Looking up error 531:

# for hex 0x531 / decimal 1329 :

  ERROR_INVALID_WORKSTATION                                    winerror.h    
# Logon failure: user not allowed to log on to this computer.

Which lines up with the error you looked up.

0

I think this is actually what you're looking for: http://www.imrantariq.com/blog/data-codes-related-to-ldap-error-code-49-with-microsoft-active-directory/

525 user not found
52e invalid credentials
530 not permitted to logon at this time
531 not permitted to logon at this workstation
532 password expired
533 account disabled
701 account expired
773 user must reset password
775 user account locked
0

Here's a slightly more complete version:

525 user not found
52e invalid credentials
530 not permitted to logon at this time
531 not permitted to logon at this workstation
532 password expired
533 account disabled 
534 The user has not been granted the requested logon type at this machine
701 account expired
773 user must reset password
775 user account locked

Common Active Directory LDAP bind errors:

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893 HEX: 0x525 - user not found DEC: 1317 - ERROR_NO_SUCH_USER (The specified account does not exist.) NOTE: Returns when username is invalid.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 52e, v893 HEX: 0x52e - invalid credentials DEC: 1326 - ERROR_LOGON_FAILURE (Logon failure: unknown user name or bad password.) NOTE: Returns when username is valid but password/credential is invalid. Will prevent most other errors from being displayed as noted.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 530, v893 HEX: 0x530 - not permitted to logon at this time DEC: 1328 - ERROR_INVALID_LOGON_HOURS (Logon failure: account logon time restriction violation.) NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 531, v893 HEX: 0x531 - not permitted to logon from this workstation DEC: 1329 - ERROR_INVALID_WORKSTATION (Logon failure: user not allowed to log on to this computer.) LDAP[userWorkstations: ] NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 532, v893 HEX: 0x532 - password expired DEC: 1330 - ERROR_PASSWORD_EXPIRED (Logon failure: the specified account password has expired.) LDAP[userAccountControl: ] - PASSWORDEXPIRED NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 533, v893 HEX: 0x533 - account disabled DEC: 1331 - ERROR_ACCOUNT_DISABLED (Logon failure: account currently disabled.) LDAP[userAccountControl: ] - ACCOUNTDISABLE NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 701, v893 HEX: 0x701 - account expired DEC: 1793 - ERROR_ACCOUNT_EXPIRED (The user's account has expired.) LDAP[accountExpires: ] - ACCOUNTEXPIRED NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 773, v893 HEX: 0x773 - user must reset password DEC: 1907 - ERROR_PASSWORD_MUST_CHANGE (The user's password must be changed before logging on the first time.) LDAP[pwdLastSet: ] - MUST_CHANGE_PASSWD NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 775, v893 HEX: 0x775 - account locked out DEC: 1909 - ERROR_ACCOUNT_LOCKED_OUT (The referenced account is currently locked out and may not be logged on to.) LDAP[userAccountControl: ] - LOCKOUT NOTE: Returns even if invalid password is presented

The DEC: values are not presented in Portal logs; however, review of LDAP activity combined with analysis of SystemOut.log and relevant configuration tasks can help narrow down the root cause.

Ref: http://www-01.ibm.com/support/docview.wss?uid=swg21290631

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .