## TL;DR
Error 53 means the server understood the request but refuses the operation as sent, most often an insecure connection for a password set, a policy violation, or a referral the client must follow. Switch the create to a secure LDAPS connection, set the password through the secure channel with a compliant value, and confirm the target container accepts the object class and attributes being sent.

```text
Active Directory user creation failed with LDAP error 53 unwilling to perform
```

## Use this when
- An LDAP or provisioning tool reports error 53 or unwilling to perform on the user add operation.
- The same tool can read and search the directory successfully.
- Manual creation in AD Users and Computers succeeds for the same organizational unit.

## Not for this skill when
- Bind itself fails with invalid credentials. Fix the service account before the add operation.
- Error 32 or 68 appears instead. Those name missing objects and duplicates respectively.

## Steps
1. Capture the full LDAP result from the provisioning log, including the operation, the distinguished name attempted, and any extended error text the domain controller returned, because AD often appends a reason such as a password or referral hint after the code. Verify: the extended detail for error 53 is recorded
2. Check the connection security: confirm the tool connects over LDAPS on the secure port with a valid certificate chain, because AD refuses password-setting operations over an unencrypted bind even when other reads work. Test the secure bind with the same service account before changing records. Verify: a secure bind succeeds with the provisioning account
3. Review the add payload against policy: a compliant initial password set over the secure channel, no conflicting account control flags, and required attributes for the object class such as sAMAccountName present and well formed. Correct any field the extended error or policy names. Verify: the payload passes a manual checklist against the domain policy
4. Confirm the target container: the organizational unit path must exist exactly as written, and if the response indicates a referral, point the tool at the correct domain or partition instead of retrying against the wrong naming context. Verify: the container resolves in ADSI Edit or the directory browser
5. Retry the single user creation through the provisioning tool and confirm the account appears, is enabled per the onboarding pattern, and can have its password set by the user at first sign-in. Verify: the add returns success and the account state is correct
6. Fix the tool configuration permanently: enforce LDAPS, store the corrected container path, and add a pre-flight check that fails loudly on an insecure connection instead of surfacing as error 53 on a live hire. Verify: the configuration shows LDAPS enforced and a test create passes

## Why it happens
LDAP error 53 is the directory server refusing an operation it considers invalid in context rather than malformed. Active Directory uses it heavily for password operations attempted without the required connection security, for policy combinations the server will not accept, and for operations aimed at the wrong partition. Because binds and searches still succeed, teams often suspect permissions and waste time, while the real gate is the operation conditions. Sending the same add over a secure connection with a compliant payload is accepted immediately, which is why reproducing with attention to transport and payload finds the cause quickly.

## Variants and edge cases
### Error 53 only when setting the password
Separate the create from the password set in the tool if needed: create the account disabled over the secure channel, then set the password, then enable, confirming each stage logs success.

### Error 53 on a specific domain controller
A single controller with a certificate or time problem can refuse secure operations. Point the tool at a healthy controller and repair the outlier certificate chain.

### Error 53 after a domain upgrade
Newer functional levels tighten default security for LDAP signing and channel binding. Update the client library and enforce signing rather than relaxing the server.

Compatibility: Applies to Active Directory Domain Services with LDAP and LDAPS clients including provisioning connectors and scripts. Requires domain admin tools for diagnosis.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GVpuQhHS29r1CAag_bWDzg