Assuming all other configuration in CUPS and CUCM is correct (licensing, devices, lines, user association, etc.) you will have intermittent desk phone control, if any, when using port 389 to authenticate CUCM against AD.
By changing LDAP authentication in CUCM to use the AD global catalog on port 3268 your problem is solved.
It got me.