Failed to get SID from AD: list index out of range

cannot sync windows AD accounts with UCS (as a member of windows AD).
It worked for few months (I’ve installed UCS with wekan a year ago). Few weeks ago I started to update UCS and Wekan to the newest versions. All worked ok, till I wanted to enable new user to use wekan app. AD accounts stopped to sync with UCS. In /connector-status.log is the message from subject.
univention-ad-connector.service failed to start (be active)
I’ve installed new UCS server, added to the domain, installed AD Connector - same results.
Anybody experience same problem?
thanks in advance