Skip to main content
NetApp Knowledge Base

CONTAP-821088: LDAP connections to Active Directory fail with Invalid Credentials after Microsoft October 2026 domain controller updates when session-security-for-ad-ldap is "none"

  1. Last updated
  2. Save as PDF
Views:
15,416
Visibility:
Public
Votes:
5
Category:
ontap-9
Specialty:
nas
Last Updated:

Issue

  • If ONTAP SVM's default LDAP client session security setting is set to none it cannot complete an LDAP bind to affected domain controllers
  • Domain Controllers may be marked unavailable for LDAP service
  • Operations that depend on Active Directory LDAP and related administrative workflows can fail:
    • CIFS server creation or modification,
    • Active Directory domain discovery,
    • name mapping,
    • user and group lookups,
    • NFS UNIX identity mapping when LDAP is used,
    • NFS clients can mount NTFS-style volumes but are unable to list or modify directories.
    • CIFS share access can be affected when authorization or identity resolution depends on LDAP;
    • SMB sign-in using Kerberos or NTLM alone is often unaffected, but user name formats that trigger extra Active Directory domain cache lookups (for example UPN or FQDN-style names) can fail when LDAP bind fails.

  • EMS and SECD log examples:
    • EMS:


  • secd.ldap.noServers: None of the LDAP servers configured for Vserver are currently accessible via the network for LDAP service type


  • secd: secd.ldap.noServers:EMERGENCY]: None of the LDAP servers configured for Vserver (admin) are currently accessible via the network for LDAP service type (Service: LDAP (Active Directory), Operation: SiteDiscovery).


  •  secd.conn.auth.failure:notice]: Vserver (svm1) could not authenticate over the network to server (dc1). Error: Invalid credentials (Service: LDAP (ActiveDirectory), Operation: SiteDiscovery). secd.conn.auth.failure:notice]: Vserver (svm1) could not authenticate over the network to server (dc1). Error: Invalid credentials (Service: LDAP (Active Directory), Operation: MapADDomainToNetbiosDomain).
    • SECD:


      • AdditionalErrorMessage: 80090303: LdapErr: DSID-0C0906D1, comment: The GSSAPI target name does not match any LDAP SPN's registered for this server., data 0, v4f7c RESULT_ERROR_LDAPSERVER_INVALID_CREDENTIALS:7627 ldapSaslBindSpnego: LDAP Error (49): 'Invalid credentials'

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.