| Previous | Next |
| ERROR_DS_NO_NTDSA_OBJECT | ERROR_DS_AUDIT_FAILURE |
ERROR_DS_NON_ASQ_SEARCH
ASQ replaces normal scope with the DNs stored in one attribute
ERROR_DS_NON_ASQ_SEARCH indicates misuse of the Active Directory Attribute Scoped Query control. ASQ requires a base-object search. Instead of searching the base object or its descendants, the server reads a named Object(DS-DN) attribute on that object and evaluates the filter against the entries referenced by those DN values.
Set search scope to base, supply the ASQ request control with the source attribute’s LDAP display name, and confirm that the attribute uses a DN syntax. The returned entries can span references, but the contacted domain controller may not hold every referenced object; parse the ASQ response control for partial or multi-DSA outcomes. Do not combine ASQ with a subtree design and expect both scopes to apply. If recursive traversal is required, perform explicit iterations with cycle and size limits.
ASQ request checks
- Base DN and base-object scope.
- Source attribute named in the control.
- Object(DS-DN) syntax and actual DN values.
- ASQ response-control result.
References
- MS-ADTS: ASQ scope, encoding, and response values
- Microsoft: LDAPv3 extended-control requirements
- IETF RFC 4511: search request and controls
Looking for a different code? Search another status or error code.