Max users allowed reached, creating new LDAP users in inacti

Error message

Max users allowed reached, creating new LDAP users in inactive state

What it means

The workspace license's active-user cap has been reached: License.shouldPreventAction('activeUsers') returned true while the LDAP user converter was inserting new users. Instead of blocking the sync, new LDAP users are created in an inactive state (userData.deleted = true) to stay within the license. Existing users are untouched; only newly synced users come in deactivated.

Source

Thrown at apps/meteor/server/lib/ldap/UserConverter.ts:54

		if (data.emails.length) {
			const emailUser = await Users.findOneWithoutLDAPByEmailAddress(data.emails[0], {});

			if (emailUser) {
				return emailUser;
			}
		}

		if (data.username) {
			return Users.findOneWithoutLDAPByUsernameIgnoringCase<IUser>(data.username);
		}
	}

	override async insertUser(userData: IImportUser): Promise<IUser['_id']> {
		if (!userData.deleted) {
			// #TODO: Change the LDAP sync process to split the inserts and updates into two stages so that we can validate this only once for all insertions
			if (await License.shouldPreventAction('activeUsers')) {
				logger.warn({ msg: 'Max users allowed reached, creating new LDAP users in inactive state ', username: userData.username });
				userData.deleted = true;
			}
		}

		return super.insertUser(userData);
	}

	static async convertSingleUser(userData: IImportUser, options?: UserConverterOptions): Promise<void> {
		const converter = new LDAPUserConverter(options);
		await converter.addObject(userData);
		await converter.convertData();
	}
}

View on GitHub (pinned to b2c16d5842)

Solutions

Deactivate users that no longer need access (Administration > Users) to free active seats
Apply a license with a higher active-user limit (upgrade/renew)
Tighten LDAP_User_Search_Filter / sync scope so only intended users are imported
After seats are freed, re-run the LDAP sync (or manually activate the users) so previously synced inactive users become active

Defensive patterns

Strategy: validation

Validate before calling

import { License } from '@rocket.chat/license';

if (await License.shouldPreventAction('activeUsers')) {
  // alert admins BEFORE running sync: seats exhausted, new LDAP users will be created inactive
  Notifications.notifyAdmins({ msg: 'License active-user limit reached; LDAP sync will deactivate new users' });
}

Prevention

Monitor active-user count against the license limit and alert before it is reached
Scope LDAP_User_Search_Filter so only needed users are imported
After raising seats, re-run the sync to activate users that came in inactive

When it happens

Trigger: An LDAP login or LDAP_DataSync run inserts new users when the workspace already has as many active users as the license allows — e.g. onboarding new employees via LDAP after seats ran out.

Common situations: Company grows past the licensed seat count between license renewals; LDAP sync filter broader than expected imports service accounts or contractors; test workspaces with small trial licenses syncing a whole directory.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/a68b33617f1db8bc. Report an issue: GitHub.