What does Windows error code 8236 (ERROR_DS_UNAVAILABLE_CRIT_EXTENSION) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_DS_UNAVAILABLE_CRIT_EXTENSION the server does not support the requested critical extension.

Previous	Next
ERROR_DS_REFERRAL	ERROR_DS_CONFIDENTIALITY_REQUIRED

ERROR_DS_UNAVAILABLE_CRIT_EXTENSION

ERROR_DS_UNAVAILABLE_CRIT_EXTENSION (0x0000202C) is an Active Directory Domain Services LDAP result. The request marked an LDAP control or extension as critical, but the server does not support it.

What to check

Identify the requested LDAP control or extended operation in the client trace.
Do not silently drop a critical control: the client must change behavior or use a server that supports it.
Check the RootDSE supportedControl and supportedExtension capabilities of the target server.

Useful command

Get-ADRootDSE -Server "<dc-fqdn>" | Select-Object supportedControl,supportedExtension

Microsoft: AD DS LDAP operations · Microsoft: LDAP ETW tracing · Microsoft: AD DS diagnostic logging

Looking for a different code? Search another status or error code.