LDAP-Managed Users Cannot Be Deactivated from System Console or API (v10.2.0+)

Applies to: Mattermost 10.2.0 and later; AD/LDAP authentication enabled with EnableSync: true

Symptoms: Attempting to deactivate an LDAP-authenticated user from System Console returns an error; PUT /api/v4/users/{userId}/active returns HTTP 403.

🛑 Problem

Starting in Mattermost v10.2.0, deactivating users whose accounts are managed by AD/LDAP authentication is intentionally blocked in System Console and via the PUT /api/v4/users/{userId}/active API. Admins who attempt to use the "Deactivate" button in System Console > User Management > Users, or the equivalent API call, receive an HTTP 403 error. The block applies to all users with an LDAP AuthService and does not depend on admin role or permissions. Deployments that upgraded from a version before v10.2.0 will have lost a previously working workflow.

Symptoms

You cannot modify user status. User is managed by LDAP

• "Deactivate" in System Console > User Management > Users fails for LDAP-authenticated users; the same button still works for non-LDAP accounts.
• PUT /api/v4/users/{userId}/active with {"active": false} returns HTTP 403 for any user with AuthService == "ldap".
• Users who were deactivated before the v10.2.0 upgrade remain deactivated; the block only prevents new deactivations through these paths.
• The TeamSettings.EnableUserDeactivation setting does not affect this behavior - it controls only user self-deactivation, not admin deactivation.

💡 Recommendation

Manage LDAP user deactivation through the directory or a sync filter. Mattermost will deactivate the user automatically on the next sync and revoke all active sessions.

Remove the User from the AD/LDAP Directory

Remove the user's account from your AD/LDAP server. On the next scheduled LDAP sync (default: every 60 minutes), Mattermost will deactivate the account and revoke all active sessions.

To trigger an immediate sync without waiting for the interval: navigate to System Console > Authentication > AD/LDAP and select AD/LDAP Synchronize Now.

Use a User Filter to Exclude the User

Set a User Filter in System Console > Authentication > AD/LDAP > User Filter to select only the subset of directory users who should have Mattermost access. Users removed from the filtered group are deactivated on the next sync.

To exclude users with a disabled Windows account flag, set the filter to:

(&(objectCategory=Person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

⚠️ Important: Changes to the User Filter affect all LDAP-authenticated users. Verify the filter expression against your directory structure before saving.

Switch the User to Email/Password Authentication

Use this when you need to deactivate a user immediately and cannot make a corresponding AD/LDAP change at the same time.

In System Console > User Management > Users, select the user, then select Switch to Email/Password. Once converted, the user's account is no longer treated as LDAP-managed, and the Deactivate button works normally.

⚠️ Important: Test on a non-critical account before using this broadly. If the user still exists in AD/LDAP, the next sync may re-link the account and reactivate them. Remove the user from AD/LDAP or update the User Filter in parallel to prevent reactivation.

Additional Resources

• Deactivating AD/LDAP Users