| Previous | Next |
| ERROR_DS_ALIASED_OBJ_MISSING | ERROR_DS_ALIAS_POINTS_TO_ALIAS |
ERROR_DS_BAD_NAME_SYNTAX
The directory rejected the supplied name syntax
A distinguished name is structured data, not a comma-separated display string. RFC 4514 defines escaping and textual representation for LDAP DNs, while Active Directory applies additional naming constraints for particular objects. A string can look readable to an administrator and still fail because an RDN is malformed, an escape is wrong, or an object-specific naming rule is violated.
Capture the original Unicode value before any logging or shell escaping changes it. Parse the DN into RDN and attribute-value components and validate the leaf RDN against the intended object type. Do not fix this by globally removing commas, plus signs, backslashes, or spaces; those characters can be legal when represented correctly.
What to inspect
- Compare the exact wire/API value with its logged representation.
- Use an LDAP DN parser and RFC 4514 escaping rules.
- Check Active Directory object-specific naming constraints after basic DN parsing succeeds.
References
- IETF RFC 4514: string representation of LDAP distinguished names
- IETF RFC 4512: LDAP directory model, aliases, DNs, and schema
- MS-ADTS: constraints on Active Directory Add operations
Looking for a different code? Search another status or error code.