Technical Tip: nca_s_fault_access_denied

[sharmaj]

Description	This article describes when users will see the AD connector showing down.
Scope	All FortiOS versions.
Solution	Sometimes the AD connector is showing down under external connectors. Make sure to check all these things before investigating further: Check whether there is reachability with the FSSO agent. Check whether the firewall rules on the Microsoft AD server are created to allow ports TCP 8000 and UDP 8002. If these steps do not work, it is possible to encounter this: When the packet captures is captured to see the transaction between the FortiGate and Microsoft AD, some error will appear: nca_s_fault_access_denied being sent from the server: This is generally an issue related to the Microsoft server where the user trying to add the FortiGate to the domain does not have full access. Refer to this article and give permissions to the user accordingly: Technical Tip: Restricting a Fortinet Single Sign On Agent Service (FSSO) service account. Microsoft reference link regarding user permissions: net user /domain returns "Access is denied"