Sub-Error Codes for LDAP Error 49


By: geoffc

January 24, 2007 3:07 am

Reads: 414




When using the Active Directory Driver with Novell Identity Manager, you may sometimes see an LDAP error 49 in your DSTrace. This means the account credentails could not log in correctly.


Here are the error codes you might see along with error 49, and their definitions:

  • 525 – user not found
  • 52e – invalid credentials
  • 530 – not permitted to logon at this time
  • 531 – workstation restriction
  • 532 – password expired
  • 533 – account disabled
  • 568 – too many contexts ids (too many group memberships)
  • 701 – account expired
  • 773 – user must reset password
  • 775 – user is intruder locked

It’s useful to know what to do next to resolve the problem. For a 525 error, you probably have the Bind DN wrong. Remember that in AD, the default Users container on a fresh install is an odd object class, whose naming attribute is actually cn=Users(,dc=acme,dc=com) instead of what you might be expecting (such as ou=Users,dc=acme,dc=com).

If you see a 52e, it means you sent the wrong password. And so on and so forth.

You will often see a “sub-error” code that may be quite informative.

VN:D [1.9.22_1171]
Rating: 5.0/5 (1 vote cast)
Sub-Error Codes for LDAP Error 49, 5.0 out of 5 based on 1 rating

Tags: , , , , ,
Categories: Identity Manager, Technical Solutions

Disclaimer: As with everything else at NetIQ Cool Solutions, this content is definitely not supported by NetIQ, so Customer Support will not be able to help you if it has any adverse effect on your environment.  It just worked for at least one person, and perhaps it will be useful for you too.  Be sure to test in a non-production environment.


  1. By:IMsyncUnit

    531 – workstation restriction

  2. By:geoffc

    Thanks! Thats a good one! Got any more? Will update the article.