| Previous | Next |
| ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS | ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED |
ERROR_DS_UNICODEPWD_NOT_IN_QUOTES
Active Directory decodes quotes as part of the password wire format
ERROR_DS_UNICODEPWD_NOT_IN_QUOTES is returned after the domain controller BER-decodes the unicodePwd octet string and finds that the first and last UTF-16 characters are not quotation marks. The quotes delimit the password for this LDAP operation; they are removed by the server and are not part of the resulting password.
Construct the value as a quoted Unicode string, encode it as UTF-16 little-endian, and pass the resulting bytes as the LDAP attribute value without an additional text conversion. A password change uses delete-old followed by add-new values, while an administrative reset uses replace; each supplied password value needs the same encoding. Use an adequately protected SSL/TLS or SASL-encrypted connection and the correct control access right. Logging only the printable password hides byte-order and quoting mistakes, so record lengths and a redacted hexadecimal envelope instead.
Encoding sequence to verify
- Opening and closing UTF-16 quote code units.
- UTF-16 little-endian byte length.
- Delete/add change versus replace reset operation.
- TLS or SASL confidentiality and authorization right.
References
- MS-ADTS: exact unicodePwd decoding procedure
- MS-ADTS: password change and reset operations
- ITU-T X.690: BER octet-string encoding
Looking for a different code? Search another status or error code.