| Previous | Next |
| ERROR_DS_ENCODING_ERROR | ERROR_DS_FILTER_UNKNOWN |
ERROR_DS_DECODING_ERROR
The failure identifies malformed bytes, not a semantic directory rejection
ERROR_DS_DECODING_ERROR means a received or supplied value is not a valid encoding of the structure Active Directory expected. Typical cases include malformed LDAP controls, truncated BER length fields, an incorrect ASN.1 tag, invalid nested control data, or a specially encoded attribute such as unicodePwd that is not a BER octet string.
Preserve the exact bytes at the protocol boundary before a library converts them. Compare the outer LDAP message and any embedded BER value separately, because either layer can fail. Validate definite lengths against the available buffer, decode the documented ASN.1 sequence, and verify that the client did not base64-decode or UTF-8-convert binary data twice. A packet capture can show whether corruption occurred before transmission, on receipt, or only in application-side parsing. Retrying the same bytes will not fix a deterministic decode failure.
Data needed to locate the bad layer
- Raw LDAP PDU or attribute value.
- Expected ASN.1 type and actual tag.
- Declared length versus captured bytes.
- Transformation steps applied by the client.
References
- IETF RFC 4511: LDAP ASN.1 protocol elements
- ITU-T X.690: BER decoding rules
- MS-ADTS: BER decoding of unicodePwd values
Looking for a different code? Search another status or error code.