What does Windows error code 8238 (ERROR_DS_INAPPROPRIATE_MATCHING) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The LDAP filter requested a matching rule that is not valid for the target attribute syntax.

Previous	Next
ERROR_DS_CONFIDENTIALITY_REQUIRED	ERROR_DS_CONSTRAINT_VIOLATION

ERROR_DS_INAPPROPRIATE_MATCHING

ERROR_DS_INAPPROPRIATE_MATCHING (0x0000202E) is an Active Directory Domain Services LDAP result. The LDAP filter requested a matching rule that is not valid for the target attribute syntax.

What to check

Verify that the filter operator is supported for the attribute being searched.
Check whether the client uses an extensible match rule, substring filter, or ordering comparison that the attribute does not support.
Test the filter with a simple equality expression before adding complex matching logic.

Useful command

Get-ADObject -LDAPFilter "(<attribute>=<value>)" -SearchBase "DC=<domain>,DC=<tld>"

Microsoft: AD DS LDAP operations · Microsoft: LDAP ETW tracing · Microsoft: Get-ADObject

Looking for a different code? Search another status or error code.