Before users can log on to Password Depot Enterprise Server with their Windows credentials, they must first be imported into the Server Manager via Active Directory import. This article summarizes the requirements and explains the most common error patterns during import and synchronization.
Requirements and permissions
Start the import in the Server Manager via Tools → Active Directory Import. Enter the LDAP path, domain name, or IPv4 address of your AD server; LDAP:// is the preset protocol.
Sign in as the current Windows user (Sign in as current user) or select Use this account. The import account needs read access to the Active Directory, in particular to the member/memberOf attributes (group memberships). If the default account's permissions are not sufficient, specify a dedicated service account with the required read access.
Only users and groups are synchronized – the Enterprise Server cannot work with organizational units (OUs). Nested groups are imported together with their parent groups unless you uncheck them manually.
Automatic synchronization
Under Manage → Server settings → Active Directory (section Synchronization), you define the protocol and interval of automatic synchronization; the smallest interval that can be set is 60 minutes. It runs under the server service's account (default: SYSTEM) – this account also needs the read permissions mentioned above. In addition, you specify what happens to users/groups that are no longer found in AD: they can be ignored, disabled, or deleted. Recommendation from the manual: preferably trigger synchronization manually, or run it, for example, every 24 hours at times of low server load.
Typical errors
"Multiple connections … are not allowed": Windows does not allow the same computer to be connected to the domain controller under more than one user name at the same time. If, for example, a network connection as user A already exists in Windows Explorer, the import as user B fails. Use the same account or disconnect the existing connection. The error also occurs if the same account is already connected from another computer.
Users "disappear" or can no longer log in after a server update: Since version 18.0.7, ADStrictNaming=1 is set in pdserver.ini. Older imports (WinNT paths, e.g. carried over from version 12 or older) then no longer match; the warning "Objects of users with WinNT Active Directory path found …" also belongs to this pattern. Solution: re-import via Tools → Active Directory Import with the option Recursively scan all containers enabled – this reliably replaces WinNT with LDAP paths. Alternatively, you can set the value to 0; stop the server service beforehand. Also check whether the auto-sync option for objects that are not found is set to deleted – in that case, such users are actually removed.
Multiple domains: Importing across domain boundaries only works within the same forest with an existing trust relationship. For this, select the GC:// protocol (Global Catalog) instead of LDAP://. A separate server instance is required for each forest.
Note: The Enterprise Server does not store AD passwords. During login, the password entered is validated against the Active Directory; for this, the client PC must be a member of the domain.
Related topics:
Setting up Single Sign-On (SSO) login to the Enterprise Server and troubleshooting errors
Connecting Entra ID (formerly Azure AD) to the Enterprise Server
Warning "Objects of users with WinNT Active Directory path found …"