Unable to set password – The object does not exist (NO_OBJECT)

This article explains a scenario where a password set or reset fails even though the user exists in Active Directory.

A password set or reset action fails with an error similar to:

This can occur during:

The user account exists in Active Directory at the time of the failure.

The issue is caused by password-related flags on the user object, most commonly:

When this flag is set, Active Directory may reject LDAP password modify operations and return a misleading NO_OBJECT error, even though the user object is valid and resolvable.

This is expected Active Directory behaviour and is not specific to Activate.

Active Directory successfully resolves the user’s distinguished name, which is reflected in the “best match of” value in the error.

The failure occurs during the extended password modify operation, not during object lookup. Active Directory surfaces this failure as problem 2001 (NO_OBJECT), which incorrectly implies that the object does not exist.

This issue is most commonly seen when:

On the affected user account, check whether:

If either condition is true at the time of the password operation, this issue is expected.

Update the workflow sequencing so that one of the following approaches is used:

Once the flag is cleared, the password operation completes successfully.

If the workflow is orchestrated through Activate Orchestrator, ensure that password operations and password flag updates are handled as separate, correctly ordered steps.

This issue is not caused by:

The user object exists and can be resolved by Active Directory. The failure is caused by the state of password-related flags at the time of the password operation. Although the error message is misleading, it is expected behaviour. Correct sequencing resolves the issue permanently.