Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows Server 2008 R2 Active Directory domain controller with domain

I have a Linux box which is trying to connect to LDAP (389) on above box, which is failing.

Upon inspection in Wireshark, I see a bind request with following query sAMAccountName=Administrator,DC=madhurmoss,DC=com

and result with

invalid Credentials 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db0

I want it to connect it through Administrator which lies in CN=Administrator,CN=Users,DC=madhurmoss,DC=com

The supplied credentials are correct. I believe the query sAMAccountName=Administrator,DC=madhurmoss,DC=com is wrong.

Can anyone guide me what could be wrong ?

share|improve this question
What is your bind command? Are you specifying the username and password? Sounds like that is what you need to do. Also, probably better to do that over LDAP/SSL port 636. – Greg Askew Dec 9 '12 at 15:31

Use CN=Administrator,CN=Users,DC=madhurmoss,DC=com as your binddn string. That should do it.

share|improve this answer
Its not working. I even tried (&(samAccountName=Administrator,CN=Users,DC=madhurmoss,DC=com)(objectClass=user)‌​) . But no result. I am trying in LDAP Browser as well. – Madhur Ahuja Dec 9 '12 at 19:19
That's a filter, not a DN – Terry Gardner Dec 10 '12 at 11:12

I usually use Apache Directory Studio to graphically browse to what is needed and then I right click and Copy DN from there. Makes things a ton easier. Not that LDAP formatting is tricky but it has saved me on typos, switching CN for OU, etc.

Give a go with that and see how it works. Plus, it'll let you know if it is a permissions issue you are having.

share|improve this answer
I am using LDAP Browser for the same. I tried the solution suggested by mgabriel but its not working. – Madhur Ahuja Dec 9 '12 at 19:19
What does your config on the linux box look like? What about your hierarchy in AD - is it like above or is the administrator account in some other folder than "Users"? – mgabriel Dec 9 '12 at 19:48

The string sAMAccountName=Administrator,DC=madhurmoss,DC=com isn't a valid X.500 definition. The attribute sAMAccountName is a valid attribute for all Security Principals, but it's not a valid X.500 node type (DC, OU or CN are). I'd be looking at your LDAP bind definition. What LDAP implementation are you using?

share|improve this answer
Active Directory – Madhur Ahuja Dec 9 '12 at 21:27
Sorry, I meant client-side. – Simon Catlin Dec 9 '12 at 21:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.