• State Verified Answer
  • Replies 1 reply
  • Subscribers 95 subscribers
  • Views 1545 views
  • Users 0 members are here
Options
Related

Error while creating user in AD

himani1 j
over 2 years ago

While creating user in AD we are getting Access denied error as below. User is created in ADSAccount table but not in AD. Full rights/permission is provided to service account on the OU in which we are trying to create user.

\REMOTEJOBSERVER1 - VI.Projector.JobComponent.ProjectorComponent - 16906308-e248-4c2e-a1db-6c60e880a5fc: Errors occurred
[1777018] Error running synchronization project (Active Directory Domain (DC=XXX,DC=LOCAL))'s workflow (Provisioning).
[1777124] Error running synchronization step (user) of synchronization configuration (Provisioning (Provisioning)).
[1777004] Method (Insert object (Insert)) could not be run successfully.
[System.UnauthorizedAccessException] Access is denied.

at VI.Projector.JobComponent.ProjectorComponent._AdHocProjection()
at VI.Projector.Database.ProjectorExecutor.Project(ISession session, IProjectionConfiguration configuration, ProjectionOption options, ISystemObject adHocObject, CancellationToken cancellationToken)
at VI.Projector.Projection.Extensions.Execute(IProjectorEngine engine, IProjectionConfiguration configuration, ProjectionOption options, ISystemObject adHocObject, CancellationToken cancellationToken)
at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)

Thanks in advance !

  • +1 over 2 years ago

    Hi,

    You could try running the provision with the connector in trace mode to see if that gives you anything more but I suspect it will just tell you the same.

    You need to speak to your AD team and verify the permissions of the service account you are using.  It could well be that it has full permissions but the permissions on the container you are trying to provision to may be more granular.

    Have the AD team try the account creation natively using your service account.  They should be able to see/capture any errors.

    For whatever reason, your account does not have the permission to create that object in that place.

    HTH, Barry.