| Previous | Next |
| ERROR_DS_CANT_DEREF_ALIAS | ERROR_DS_OBJECT_BEING_REMOVED |
ERROR_DS_OUT_OF_SCOPE
The operation crossed a directory scope boundary
LDAP operations are evaluated relative to a target DN, search base, naming context, and sometimes server-specific capabilities. An object can exist in the forest but still be outside the scope in which the current operation is defined. This is especially relevant when a client assumes that one domain controller transparently owns every forest partition.
Compare the target DN with the server's naming contexts from rootDSE and with the operation type. A subtree search scope is not the same thing as a naming-context ownership boundary, and changing LDAP search scope does not make a write operation valid in a remote partition. Follow referrals or select an appropriate writable server when required.
What to inspect
- Record base DN, LDAP scope, target DN, and contacted DC.
- Map the target to a naming context using rootDSE metadata.
- Distinguish client search scope from directory partition scope.
References
- IETF RFC 4511: LDAP protocol operations and result semantics
- Microsoft: RootDSE naming-context metadata
- MS-ADTS: constraints on Active Directory Modify operations
Looking for a different code? Search another status or error code.