Interested to know if anyone else has come across this. Customer has Secure LDAP LB VIPs on their NetScaler (ie LDAP over SSL) and LDAP auth actions talking to this LB VIP. Recently the AAAD process started crashing frequently taking down the appliance multiple times a day. Citrix Support pointed us to this article, and requested we talk to the local LB VIP via 389 (unencrypted LDAP) but the LB VIP can still use Secure LDAP to the back end services (domain controllers). It's a VPX200 and is only under a very light load - and I've never seen this be an issue before even on very heavily loaded systems. https://support.citrix.com/article/CTX230883/high-mgmt-cpu-due-to-nsaaad-process

I think its fine to use 389 as long as you also use start tls https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/8e73932f-70cf-46d6-88b1-8d9f86235e81. I thought this was what ms preferred.

What NS version?

I do that on my heavily used NS VPX (on SDX) 13.1 51.15 and no issue. I have an instability issue on this build because SNMP syslog alert, disabling almost fix the issue.

Sorry for the slow reply - been on holiday. @Carl Behrent according to Citrix this happens on all versions - this particular customer is on 13.0