Common Error Codes for Active Directory Authentication
Luke Hebert
- 3 minutes read - 456 wordsWhen an Active Directory bind fails, the error message can be cryptic at first glance. Understanding the numeric code after the data field is the fastest way to pinpoint whether the problem is a bad password, a locked account, or something else entirely.
A typical error looks like this:
INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580
INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 775, v1db1The code you care about is the number listed after data (in the examples above, 52e and 775).
Common Error Codes
| Error Code | Error | Description |
|---|---|---|
| 525 | User not found | Returned when an invalid username is supplied. |
| 52e | Invalid credentials | Returned when a valid username is supplied but an invalid password or credential is provided. If this error is received, it will prevent most other errors from being displayed. |
| 530 | Not permitted to logon at this time | Returned when a valid username and password are supplied during a time window when login is restricted. |
| 531 | Not permitted to logon from this workstation | Returned when a valid username and password are supplied, but the user is restricted from using the workstation where the login was attempted. |
| 532 | Password expired | Returned when a valid username is supplied and the password is valid but expired. |
| 533 | Account disabled | Returned when a valid username and password are supplied but the account has been disabled. |
| 701 | Account expired | Returned when a valid username and password are supplied but the account has expired. |
| 773 | User must reset password | Returned when a valid username and password are supplied, but the user must change their password immediately (before first login, or after an administrator reset the password). |
| 775 | Account locked out | Returned when a valid username is supplied but the account is locked out. Note that this error is returned regardless of whether the password is valid or invalid. |
Important
Error code 52e (Invalid credentials) masks other errors. If you see 52e, the account may actually be disabled, expired, or locked, but AD will not reveal that until the credential check passes. Verify the account status in AD Users and Computers before assuming the password is simply wrong.
Troubleshooting Tips
- 525 / 52e: Confirm the username spelling and check for trailing spaces. Verify the account exists in the correct OU.
- 530 / 531: Check the account’s logon hours and allowed workstations in the AD account properties.
- 532 / 773: Have the user reset their password or contact an administrator to unlock and reset.
- 533 / 701: Re-enable the account or extend the account expiration date.
- 775: Wait for the lockout policy to expire, or manually unlock the account in AD.