| Previous | Next |
| ERROR_DS_INVALID_NAME_FOR_SPN | ERROR_DS_UNICODEPWD_NOT_IN_QUOTES |
ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS
Computed response attributes are not searchable predicates
ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS indicates that the LDAP search filter names an attribute whose value is computed by Active Directory rather than stored and indexed as ordinary directory data. Constructed attributes can be returned for an object, but the directory does not support using them as filter operands.
Find the constructed term in the parsed filter and replace it with predicates over persisted source attributes where the semantics are equivalent. For back links, search the stored forward link instead, often by reversing the relationship in the query. Some computed values have no exact server-side predicate; in that case narrow the search with indexed stored attributes, request the constructed value in the result, and perform the final test in the client. Escape values according to LDAP filter syntax and avoid fetching an entire forest merely to emulate an unsupported filter.
Filter redesign checks
- Exact filter and constructed attribute name.
- systemFlags or linkID proving the attribute is constructed.
- Persisted source or forward-link attribute.
- Expected candidate count after server-side narrowing.
References
- MS-ADTS: constructed attributes are unsupported in filters
- MS-ADTS: constructed-attribute categories
- IETF RFC 4515: LDAP filter string syntax
Looking for a different code? Search another status or error code.