IQService Refuse to set Password

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

Version 8.2

Share all details related to your problem, including any error messages you may have received.

We have seen some instances where we get the below error in the logs during the AD aggregation. This pertains to creating the AD account for the identity. This doesn’t happen every time, but I’m wondering why this error is seen and what a resolution to this is?

Error:
Exception occurred while executing the RPCRequest: Errors returned from IQService. "Error occurred while setting password for the account. Exception has been thrown by the target of an invocation.The server is unwilling to process the request. (Exception from HRESULT: 0x80072035)0000052D: SvcErr: DSID-031A124C, problem 5003 (WILL_NOT_PERFORM), data 0 ", "Error occurred while setting password for the account. Exception has been thrown by the target of an invocation.The server is unwilling to process the request.

This prevents the creation of the AD account and we have to manuallt create it. Has anyone seen something similar to this?

2

There may be couple of reason why its not setting the password

  • An attempt to violate a password policy, such as history, password length, blank password, etc.
  • account may already locked
    you may need to check with Active Directory team to see if windows events or some log for actual reason of failure.
3

Usualy AD returns this exception when password which Sailpoint tried to set does not met the AD minimum password complexity policy.

Try to set more complex password and check if the error is still there.

4

The error message actually provides useful information. Specifically, this part:

0000052D: SvcErr: DSID-031A124C, problem 5003

The error code is 52D, which is a hexadecimal number corresponding to decimal 1325. Microsoft publishes a difficult-to-Google list of error codes here.

ERROR_PASSWORD_RESTRICTION
1325 (0x52D)
Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain.

3 Likes
5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.