| Previous | Next |
| ERROR_DS_INVALID_LDAP_DISPLAY_NAME | ERROR_DS_CANT_RETRIEVE_ATTS |
ERROR_DS_NON_BASE_SEARCH
fBASEONLY prevents the attribute from being returned across a subtree
ERROR_DS_NON_BASE_SEARCH is associated with attributes whose schema searchFlags includes fBASEONLY. Such an attribute can be read when the LDAP search scope is the single base object, but Active Directory rejects a request that would return it from one-level or subtree enumeration.
Inspect the requested attribute list and its attributeSchema.searchFlags, then separate the operation into a broad search for object DNs and individual base-scope reads for the restricted value. Removing the attribute from the selection can allow the original subtree search to proceed. Do not try to bypass the rule by changing the filter or enabling paging: scope, not result count, is the restriction. Also consider the performance and sensitivity implications before designing software that performs one follow-up request per result.
Search details to record
- Base DN and requested scope.
- Attribute carrying fBASEONLY.
- Whether the attribute is explicitly requested or added by a framework.
- Number of base-scope follow-up reads required.
References
- MS-ADTS: fBASEONLY and ERROR_DS_NON_BASE_SEARCH
- IETF RFC 4511: LDAP search scopes
- Microsoft: attributeSchema search characteristics
Looking for a different code? Search another status or error code.