This is the first time to post a question to StackExchange.

Could you please help me about configuration of LDAP? Now I'm configuring LDAP at Tridion 2013 on Windows 2008. I have already done the followings according to Tridion installation manual.

  1. changed Authentication settings of IIS.
  2. modified a web.config file which was located in the web\ subfolder.
  3. modified a web.config file which was located in the web\WebUI\WebRoot subfolder.
  4. modified a web.config file which was located in the webservices subfolder.
  5. configured a Directory Services
  6. deselected 'GroupSync Enabled' to disable group synchronization because I'm setting up development environment.
  7. changed a User Type of the impersonation user setting to 'Directory Service'.
  8. applied LDAP configuration changes by restarting IIS, COM+ and Windows services.

After that, I could login Tridion Content Management Console, but there was error message in message center of TCME.

Access is denied for the user NT AUTHORITY\NETWORK SERVICE.

There was the following error in event log.

Access is denied for the user NT AUTHORITY\NETWORK SERVICE.

Component: Tridion.ContentManager.CoreService
Errorcode: 770

StackTrace Information Details:
   場所 Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String userName, IEnumerable`1 mappedGroupUris, IEnumerable`1 claimSets)
   場所 Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String userName, String impersonationUserName)
   場所 Tridion.ContentManager.Session..ctor(String userName, String impersonationUserName)
   場所 Tridion.ContentManager.CoreService.CoreServiceBase.Impersonate(String userName)
   場所 SyncInvokeImpersonate(Object , Object[] , Object[] )
   場所 System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
   場所 Tridion.ContentManager.CoreService.CoreServiceInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
   場所 System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
   場所 System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
   場所 System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)
   場所 System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)

So I added an impersonation user record 'NT AUTHORITY\NETWORK SERVICE' to TRUSTEES table. As a result, the error message disappeared. But Tridion said 'Welcome, NT AUTHORITY\NETWORK SERVICE' although I logged in as administrator user.

Is it necessary to add an impersonation user record to TRUSTEES? If answer is 'No', why does not Tridion say 'Welcome, Tridion Content Management Administrator'?

I have already checked this post Unable to Initialize TDSE object when using LDAP, but I couldn't resolve this problem.

Could you please help me, again?

1 Answer 1


The impersonation user does not have to be added to the TRUSTEES table, but rather in the SDL Tridion Configuration MMC Snap In. That's way easier anyway. ;)

You can read about this in the manual and here as well. (login required)

The short version is:

  1. Start the SDL Tridion MMC Snap-in by selecting Programs > SDL Tridion > SDL Tridion Content Manager configuration in the Microsoft Windows Start menu.
  2. In the SDL Tridion MMC Snap-in, right-click on the Impersonation User icon and select New Impersonation User.
  3. Under Windows User, enter the name of the impersonation user used by the Web site. This impersonation user is associated with the NETWORK SERVICE account, and can be configured in the SDL Tridion MMC Snap-in.
  • Thank you for quick reply. I understand that it is not necessary to add the impersonation user to the TRUSTEES table. But in that case, I get the error 'Access is denied for the user NT AUTHORITY\NETWORK SERVICE.'. Are there any settings which I should confirm? Commented Jul 31, 2013 at 13:59
  • That means that impersonation is not happening. I would double check the steps in the documentation.
    – Nuno Linhares
    Commented Jul 31, 2013 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.