<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#ffffff"> OK. I Think I've got this licked. I had to manually activate the account on both the Active Directory and the FreeIPA server. I think what was happening was this: <ol> <li>Admin activates the account on IPA server (moves cn=inactivated to cn-activated) </li> <li>IPA server schedules windows sync</li> <li>IPA server reads windows status disabled</li> <li>IPA disables FreeIPA account</li> <li>IPA server updates AD account to enable</li> <li>IPA server schedules 2nd windows sync</li> <li>IPA server updates AD account to disable</li> </ol> I don't know why this account is encountering this issue. It just started flipping disabled at about 2:00 am today. </body> </html>