Error: "Apply of attribute userAccountControl with value(s) = 590338 failed" when trying to sync or migrate users in MMAD (4277982)

Chat now with support

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Error: "Apply of attribute userAccountControl with value(s) = 590338 failed" when trying to sync or migrate users in MMAD
Description

When attempting to migrate or synchronize AD accounts from one domain to another, the following error is shown in the DSA.log:
Per attribute apply failed for object.... Apply of attribute userAccountControl with value(s) = 590338 failed.
LDAP error 0x32. Insufficient Rights
Cause

The account is Trusted for Delegation in the Source Domain. This userAccountControl attribute cannot be set in the Target Domain.
Resolution

Remove the Trusted for Delegation authorization from the AD account in the Source Domain.
Additional Information

The userAccountControl value is a calculated value, based on the account settings. In the case of userAccountControl = 590338, the following values are calculated:
ACCOUNTDISABLE 2
NORMAL_ACCOUNT 512
DONT_EXPIRE_PASSWORD 65536
TRUSTED_FOR_DELEGATION 524288
For the list of values for calculating userAccountControl, please see the following TechNet article:
https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-properties

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title