NetWorker: Active Directory user cannot log in to NetWorker, LDAP error code 49 Data 52f
Summary: Active Directory users cannot log in to NetWorker and to NMC. The error generated is "incorrect username or password".
Symptoms
Active Directory users cannot log authenticate in NetWorker command-line or user interfaces (NetWorker Management Console, NetWorker Web User Interface, so forth).
nsrlogin returns the error "incorrect username or password"; however, the user's logon name and password were entered correctly.
The authc-server.log logged the following message:
Unable to get user by name '<user name>'. Reason: Incorrect result size: expected 1, actual 0 Failed to bind as <Distinguished Name of the user> Users: org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090434, comment: AcceptSecurityContext error, data 52f, v4f7c^@]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090434, comment: AcceptSecurityContext error, data 52f, v4f7c^@]
/nsr/authc/logs/authc-server.log
Windows:
C:\Program Files\EMC NetWorker\nsr\authc-server\tomcat\logs\authc-server.log
The same error message appears when attempting to update the external authority resource in NetWorker.
Cause
LDAP error code 49 means authentication error.
LDAP data error code 52f means that the Account Restrictions are preventing this user from signing in.
49 52f 1327 ERROR_ACCOUNT_RESTRICTION
In this scenario, the AD user account used to bind NetWorker AUTHC to the domain controller belonged to the "Protected Users" AD group.
Resolution
Perform one of the following actions:
- Remove the AD user account from the Protected Users Group.
- Create a new AD user account that is not part of the Protected User Security Group. The new AD user must be added to an AD group which has been granted NetWorker User Roles.
Additional Information
The following AD PowerShell command lists which AD groups the user belongs to: Get-ADPrincipalGroupMembership username | Select-Object Name
PS C:\Users\Administrator> Get-ADPrincipalGroupMembership Administrator | Select-Object Name
Name
----
Domain Users
Administrators
Schema Admins
Enterprise Admins
Domain Admins
Group Policy Creator Owners
Protected Users
Organization Management
EMC App Agent Exchange Admin Roles
For more information about Protected User Groups, see https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group 
For added security, configure NetWorker to use LDAPS instead of LDAP.