Unable to Unlock Active Directory User from Okta
Last Updated:
Okta Classic Engine
Directories
Okta Identity Engine
Overview
This article explains how to troubleshoot failures by unlocking an Active Directory account from Okta with the error:
Access is denied.
Applies To
- Active Directory (AD)
- Account Unlock
- Delegated Authentication
Cause
Enable Verbose Logging and attempt the action. See How to Retrieve Okta Logs for Troubleshooting for more details.
2023/08/23 18:29:10.964+00:00 Info -- SERVER(5) -- Authenticating user Unlock Test@TESTDOMAIN.internal
2023/08/23 18:29:10.968+00:00 Info -- SERVER(5) -- LogonUser failed with error code : 1909
2023/08/23 18:37:58.817+00:00 Verbose -- SERVER(4) -- Action:[WRITE_OBJECT], Type:[MODIFY] move from targetDN:[<GUID=A048EAA9-C1B6-466F-B6D1-F024FF763741>] to moveToDN:[] for User:[]
[REPLACE:lockoutTime: {0} ]
2023/08/23 18:37:58.937+00:00 Error -- SERVER(4) -- Error processing WRITE_OBJECT action rpc::app.active_directory.agent.reply.op3-majorecs23c.auw2-op3.internal//1692815908655//1a42c003bb2fe98079537ff9288b33bc:75c4fd2e-8a53-4147-a40a-6c43b30a13cd:
2023/08/23 18:37:58.937+00:00 Info -- SERVER at System.DirectoryServices.Interop.UnsafeNativeMethods.IAds.SetInfo()
at System.DirectoryServices.DirectoryEntry.CommitChanges()
at Okta.DirectoryServices.ActiveDirectoryAdapter.CommitChanges(IDirectoryEntry entry, IEnumerable`1 attributeChanges)
at Okta.DirectoryServices.ActiveDirectoryAdapter.ModifyObject(String targetDN, String moveToDN, String newCN, List`1 propertyChanges)
at Okta.Action.Handler.WriteActionHandler.Handle(AgentAction action, ActionContext context)
at Okta.Action.Handler.MultiTypeActionHandler.Handle(AgentAction action, ActionContext context)
at Okta.Action.Dispatch.MultiThreadedDispatcher.HandlerCallback(Object param)
System.UnauthorizedAccessException received with message Access is denied.- The login first fails with the error 1909, which means the AD account is locked.
- The agent attempts to perform a write action on the attribute
lockoutTime. - The domain returns the error: Access is denied.
Solution
Ensure the AD service account used by the Okta AD Agent has the appropriate permissions to perform write actions on the user.
