5 Appendix A: Product Behavior

The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include updates to those products.

The terms "earlier" and "later", when used with a product version, refer to either all preceding versions or all subsequent versions, respectively. The term "through" refers to the inclusive range of versions. Applicable Microsoft products are listed chronologically in this section.

  • Windows Server 2008 R2 operating system

  • Windows Server 2012 operating system

  • Windows Server 2012 R2 operating system

  • Windows Server 2016 operating system

  • Windows Server operating system

  • Windows Server 2019 operating system

  • Windows Server 2022 operating system

  • Windows Server 2025 operating system

Exceptions, if any, are noted in this section. If an update version, service pack or Knowledge Base (KB) number appears with a product name, the behavior changed in that update. The new behavior also applies to subsequent updates unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.

Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms "SHOULD" or "SHOULD NOT" implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term "MAY" implies that the product does not follow the prescription.

<1> Section 1.3: The following products are applicable to Active Directory Web Services: Data Model and Common Elements:

  • Active Directory Management Gateway Service contains the server implementation of the ADWS set of protocols that use Active Directory Web Services: Data Model and Common Elements.

  • Remote Server Administration Tools (excluding Remote Server Administration Tools for Windows Vista operating system) contains the client implementation. For more information about Remote Server Administration Tools, see [MSFT-RSAT].

  • Windows Server 2008 R2 and later contain both the server and the client implementations.

Active Directory Management Gateway Service is available for Windows Server 2003 operating system with Service Pack 2 (SP2), Windows Server 2003 R2 operating system with Service Pack 2 (SP2), and Windows Server 2008 operating system.

<2> Section 2.3.3.1: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements do not return the ad:objectReferenceProperty synthetic attribute if the requestor does not have permission to read O!objectGUID, where O is the directory object being represented as an XML view.

<3> Section 2.3.3.2: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements in Active Directory Management Gateway Service for Windows Server 2003 operating system omits this attribute from the XML view of all directory objects, regardless of whether the directory object has a parent.

<4> Section 2.3.4: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements use the following mapping between rootDse attributes (specified by their LDAP display names) and XML syntaxes.

rootDse attribute name

LDAPSYN

XML syntax (XMLSYN)

configurationnamingcontext

DSDNString

xsd:string

Currenttime

GeneralizedTimeString

xsd:string

defaultnamingcontext

DSDNString

xsd:string

Dnshostname

UnicodeString

xsd:string

Dsschemaattrcount

Integer

xsd:string

Dsschemaclasscount

Integer

xsd:string

dsschemaprefixcount

Integer

xsd:string

Dsservicename

DSDNString

xsd:string

highestcommittedusn

LargeInteger

xsd:string

Isglobalcatalogready

Boolean

xsd:string

Issynchronized

Boolean

xsd:string

Ldapservicename

UnicodeString

xsd:string

Namingcontexts

DSDNString

xsd:string

pendingpropagations

DSDNString

xsd:string

rootdomainnamingcontext

DSDNString

xsd:string

schemanamingcontext

DSDNString

xsd:string

Servername

DSDNString

xsd:string

Subschemasubentry

DSDNString

xsd:string

supportedcapabilities

ObjectIdentifier

xsd:string

Supportedcontrol

ObjectIdentifier

xsd:string

supportedldappolicies

UnicodeString

xsd:string

supportedldapversion

Integer

xsd:string

supportedsaslmechanisms

UnicodeString

xsd:string

domaincontrollerfunctionality

Integer

xsd:string

Domainfunctionality

Integer

xsd:string

Forestfunctionality

Integer

xsd:string

msds-replallinboundneighbors

UnicodeString

xsd:string

msds-replalloutboundneighbors

UnicodeString

xsd:string

msds-replconnectionfailures

UnicodeString

xsd:string

msds-repllinkfailures

UnicodeString

xsd:string

msds-replpendingops

UnicodeString

xsd:string

msds-replqueuestatistics

UnicodeString

xsd:string

msds-topquotausage

UnicodeString

xsd:string

supportedconfigurablesettings

UnicodeString

xsd:string

Supportedextension

ObjectIdentifier

xsd:string

Validfsmos

DSDNString

xsd:string

Dsaversionstring

UnicodeString

xsd:string

msds-portldap

Integer

xsd:string

msds-portssl

Integer

xsd:string

msds-principalname

UnicodeString

xsd:string

Serviceaccountinfo

UnicodeString

xsd:string

Spnregistrationresult

Integer

xsd:string

Tokengroups

SidString

xsd:base64Binary

Usnatrifm

LargeInteger

xsd:string

becomePdcWithCheckPoint

SidString

xsd:base64Binary

checkPhantoms

UnicodeString

xsd:string

doGarbageCollection

Integer

xsd:string

dumpDatabase

UnicodeString

xsd:string

fixupInheritance

UnicodeString

xsd:string

invalidateRidPool

SidString

xsd:base64Binary

recalcHierarchy

UnicodeString

xsd:string

schemaUpdateNow

UnicodeString

xsd:string

removeLingeringObject

UnicodeString

xsd:string

doLinkCleanup

UnicodeString

xsd:string

doOnlineDefrag

Integer

xsd:string

replicateSingleObject

UnicodeString

xsd:string

updateCachedMemberships

UnicodeString

xsd:string

doGarbageCollectionPhantomsNow

Integer

xsd:string

invalidateGCConnection

UnicodeString

xsd:string

renewServerCertificate

UnicodeString

xsd:string

rODCPurgeAccount

UnicodeString

xsd:string

sqmRunOnce

UnicodeString

xsd:string

runProtectAdminGroupsTask

UnicodeString

xsd:string

<5> Section 2.5.1: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements provide access to any Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) directory service that is running on the same computer as ADWS. AD DS can be accessed via "ldap:389". If the machine is also an AD DS global catalog, then the global catalog can be accessed as "ldap:3268". An AD LDS instance can be accessed as "ldap:N", where N is the LDAP port number that the AD LDS instance has been configured to use.

<6> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements include both ad:FaultDetail/ad:Error and ad:FaultDetail/ad:ShortError elements.

<7> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements use ad:FaultDetail/ad:ArgumentError to indicate that an invalid argument was passed from one internal function to another.

Element

Contents

ad:FaultDetail/ad:ArgumentError/ad:Message

A human-readable error message string explaining the nature of the argument error that occurred.

ad:FaultDetail/ad:ArgumentError/ad:ParameterName

The name of the function parameter whose argument was invalid.

<8> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements translate LDAP error codes to Win32 error codes ([MS-ERREF] section 2.2) using the following table.

LDAP Error

Win32 Error

Code (Hex)

Name

Code (Dec)

Name

0x00

LDAP_SUCCESS

0

NO_ERROR

0x01

LDAP_OPERATIONS_ERROR

8224

ERROR_DS_OPERATIONS_ERROR

0x02

LDAP_PROTOCOL_ERROR

8225

ERROR_DS_PROTOCOL_ERROR

0x03

LDAP_TIMELIMIT_EXCEEDED

8226

ERROR_DS_TIMELIMIT_EXCEEDED

0x04

LDAP_SIZELIMIT_EXCEEDED

8227

ERROR_DS_SIZELIMIT_EXCEEDED

0x05

LDAP_COMPARE_FALSE

8229

ERROR_DS_COMPARE_FALSE

0x06

LDAP_COMPARE_TRUE

8230

ERROR_DS_COMPARE_TRUE

0x07

LDAP_AUTH_METHOD_NOT_SUPPORTED

8231

ERROR_DS_AUTH_METHOD_NOT_SUPPORTED

0x08

LDAP_STRONG_AUTH_REQUIRED

8232

ERROR_DS_STRONG_AUTH_REQUIRED

0x09

LDAP_PARTIAL_RESULTS

299

ERROR_PARTIAL_COPY

0x0a

LDAP_REFERRAL

8235

ERROR_DS_REFERRAL

0x0b

LDAP_ADMIN_LIMIT_EXCEEDED

8228

ERROR_DS_ADMIN_LIMIT_EXCEEDED

0x0c

LDAP_UNAVAILABLE_CRIT_EXTENSION

8236

ERROR_DS_UNAVAILABLE_CRIT_EXTENSION

0x0d

LDAP_CONFIDENTIALITY_REQUIRED

8237

ERROR_DS_CONFIDENTIALITY_REQUIRED

0x0e

LDAP_SASL_BIND_IN_PROGRESS

590610

SEC_I_CONTINUE_NEEDED

0x10

LDAP_NO_SUCH_ATTRIBUTE

8202

ERROR_DS_NO_ATTRIBUTE_OR_VALUE

0x11

LDAP_UNDEFINED_TYPE

8204

ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED

0x12

LDAP_INAPPROPRIATE_MATCHING

8238

ERROR_DS_INAPPROPRIATE_MATCHING

0x13

LDAP_CONSTRAINT_VIOLATION

8239

ERROR_DS_CONSTRAINT_VIOLATION

0x14

LDAP_ATTRIBUTE_OR_VALUE_EXISTS

8205

ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS

0x15

LDAP_INVALID_SYNTAX

8203

ERROR_DS_INVALID_ATTRIBUTE_SYNTAX

0x20

LDAP_NO_SUCH_OBJECT

8240

ERROR_DS_NO_SUCH_OBJECT

0x21

LDAP_ALIAS_PROBLEM

8241

ERROR_DS_ALIAS_PROBLEM

0x22

LDAP_INVALID_DN_SYNTAX

8242

ERROR_DS_INVALID_DN_SYNTAX

0x23

LDAP_IS_LEAF

8243

ERROR_DS_IS_LEAF

0x24

LDAP_ALIAS_DEREF_PROBLEM

8244

ERROR_DS_ALIAS_DEREF_PROBLEM

0x30

LDAP_INAPPROPRIATE_AUTH

8233

ERROR_DS_INAPPROPRIATE_AUTH

0x31

LDAP_INVALID_CREDENTIALS

1326

ERROR_LOGON_FAILURE

0x32

LDAP_INSUFFICIENT_RIGHTS

5

ERROR_ACCESS_DENIED

0x33

LDAP_BUSY

8206

ERROR_DS_BUSY

0x34

LDAP_UNAVAILABLE

8207

ERROR_DS_UNAVAILABLE

0x35

LDAP_UNWILLING_TO_PERFORM

8245

ERROR_DS_UNWILLING_TO_PERFORM

0x36

LDAP_LOOP_DETECT

8246

ERROR_DS_LOOP_DETECT

0x3C

LDAP_SORT_CONTROL_MISSING

8261

ERROR_DS_SORT_CONTROL_MISSING

0x3D

LDAP_OFFSET_RANGE_ERROR

8262

ERROR_DS_OFFSET_RANGE_ERROR

0x40

LDAP_NAMING_VIOLATION

8247

ERROR_DS_NAMING_VIOLATION

0x41

LDAP_OBJECT_CLASS_VIOLATION

8212

ERROR_DS_OBJ_CLASS_VIOLATION

0x42

LDAP_NOT_ALLOWED_ON_NONLEAF

8213

ERROR_DS_CANT_ON_NON_LEAF

0x43

LDAP_NOT_ALLOWED_ON_RDN

8214

ERROR_DS_CANT_ON_RDN

0x44

LDAP_ALREADY_EXISTS

5010

ERROR_OBJECT_ALREADY_EXISTS

0x45

LDAP_NO_OBJECT_CLASS_MODS

8215

ERROR_DS_CANT_MOD_OBJ_CLASS

0x46

LDAP_RESULTS_TOO_LARGE

8248

ERROR_DS_OBJECT_RESULTS_TOO_LARGE

0x47

LDAP_AFFECTS_MULTIPLE_DSAS

8249

ERROR_DS_AFFECTS_MULTIPLE_DSAS

0x4c

LDAP_VIRTUAL_LIST_VIEW_ERROR

8341

ERROR_DS_GENERIC_ERROR

0x50

LDAP_OTHER

31

ERROR_GEN_FAILURE

0x51

LDAP_SERVER_DOWN

8250

ERROR_DS_SERVER_DOWN

0x52

LDAP_LOCAL_ERROR

8251

ERROR_DS_LOCAL_ERROR

0x53

LDAP_ENCODING_ERROR

8252

ERROR_DS_ENCODING_ERROR

0x54

LDAP_DECODING_ERROR

8253

ERROR_DS_DECODING_ERROR

0x55

LDAP_TIMEOUT

1460

ERROR_TIMEOUT

0x56

LDAP_AUTH_UNKNOWN

8234

ERROR_DS_AUTH_UNKNOWN

0x57

LDAP_FILTER_ERROR

8254

ERROR_DS_FILTER_UNKNOWN

0x58

LDAP_USER_CANCELLED

1223

ERROR_CANCELLED

0x59

LDAP_PARAM_ERROR

8255

ERROR_DS_PARAM_ERROR

0x5a

LDAP_NO_MEMORY

8

ERROR_NOT_ENOUGH_MEMORY

0x5b

LDAP_CONNECT_ERROR

1225

ERROR_CONNECTION_REFUSED

0x5c

LDAP_NOT_SUPPORTED

8256

ERROR_DS_NOT_SUPPORTED

0x5e

LDAP_NO_RESULTS_RETURNED

8257

ERROR_DS_NO_RESULTS_RETURNED

0x5d

LDAP_CONTROL_NOT_FOUND

8258

ERROR_DS_CONTROL_NOT_FOUND

0x5f

LDAP_MORE_RESULTS_TO_RETURN

234

ERROR_MORE_DATA

0x60

LDAP_CLIENT_LOOP

8259

ERROR_DS_CLIENT_LOOP

0x61

LDAP_REFERRAL_LIMIT_EXCEEDED

8260

ERROR_DS_REFERRAL_LIMIT_EXCEEDED

<9> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements attempt to find the ad:Message value in column B of the first table shown below.

  • If the value is found in column B of the first table, the ad:ShortMessage is populated with text from column A.

  • If no match is found in column B of the first table, ad:ShortMessage is populated from column A of the second table based on the error encountered, as described in column B.

First table:

A

B

AnonymousNotAllowed

Anonymous access to the directory is not permitted.

AttributeValueNotaObjRef

The attribute found is not a valid object reference (neither a GUID nor a string DN).

AttributeValueNotaString

The attribute found is not a String.

AttributeValueNotByteOrStringOrGuid

The attribute found is not a String, byte[] or GUID.

BadPutOrCreateValue

A Create or Put operation is being attempted with a bad value or values.

BadValue

An update is being attempted with an bad value.

BadValueForRangeHigh

Bad value has been specified for RangeHigh attribute.

BadValueForRangeLow

Bad value has been specified for RangeLow attribute.

CanOnlyReplaceParentObjectRefForUpdate

The parent object identity can only be replaced, not removed or added.

CanOnlyReplaceRdnForUpdate

The relative distinguished name (RDN) can only be replaced, not removed or added.

CantSetDistinguishedNameForCreate

The distinguished name attribute cannot be set during object creation.  It is automatically set based on the relative distinguished name (RDN) and the parent object.

CantSetDistinguishedNameForUpdate

The distinguished name attribute cannot be updated.  It is generated from the object's relative distinguished name (RDN) and the parent object.

CantSetObjectRefPropertyForCreate

The object reference property attribute cannot be set during object creation.  It is automatically assigned by the directory.

CantSetObjectRefPropertyForUpdate

The object reference property attribute cannot be changed.  It is automatically assigned by the directory at object creation.

CouldntFindObjectForMove

The object could not be found in the directory.

CouldntFindParentObjectForCreation

The parent object under which the new object is to be created could not be found in the directory.

CouldntRetrieveRootDSEForFilter

The RootDSE could not be retrieved from the directory. Please specify filter for the enumerate request under such circumstances.

CreateMissingValues

An AttributeTypeAndValue element in the Create operation did not contain any AttributeValue elements.

DuplicateAttributeWithValues

The attribute was found more than once, and has values.

DuplicateEnumerationCacheEntry

The EnumerationCacheEntry is a duplicate entry.

EmptyAttribute

The attribute has no value.

EmptyCreate

The Create operation did not contain any AttributeTypeAndValue elements.

EmptyPut

The Put operation did not contain any Change elements.

EnumContextAbsentInTheRequest

Request must specify the enumeration context.

ErrorWhileFetchingAttributeValues

Error while retrieving values for attribute {0} from the directory.

ImpersonationLevelNotSetToImpersonate

Impersonation level not set to Impersonate or higher by caller

InvalidBase64Binary

The base64Binary value len is not 4, or a multiple of 4.

InvalidDnWithStringBinaryAccessPointValue

The DN-with-binary, DN-with-string, or access-point value is in an invalid format.

InvalidEnumerationCacheEntry

The EnumerationCacheEntry is invalid.

InvalidObjectReferenceProperty

The supplied object reference property is not valid.

InvalidParentObjectRefForCreateAndUpdate

A single value must be specified for container-hierarchy-parent attribute.

InvalidPredicate

An update was specified with an invalid predicate.

InvalidPutSyntax

There is a mismatch between Put 'Operation' and the presence of an AttributeValue element

MaxEnumCtxsTotalReached

The maximum allowed number of enumeration contexts has been reached.

MissingDialect

Dialect not specified in the request.

MissingExpression

A create or update is missing an attribute.

MissingLowerRange

RangeLow attribute must be specified on the element with range qualifier.

MissingOrMultipleBaseObjectNodes

LdapQuery filter has a missing or multiple baseobject nodes

MissingOrMultipleFilterNodes

LdapQuery filter has a missing or multiple filter nodes

MissingOrMultipleScopeNodes

LdapQuery filter has a missing or multiple scope nodes

MissingScopeOrBaseObjectOrFilterNode

LdapQuery is missing the Scope, BaseObject or Filter node

MissingSelectionDialect

Selection dialect not specified in the request.

MissingSortingDialect

Sorting dialect not specified in the request.

MissingTypeAttribute

The attribute type is missing.

MissingValue

A create is missing the value for an attribute.

MustSpecifyBaseDnForQuery

Distinguished name search base must be supplied in the LdapQuery element.

MustSpecifyContainerForMove

Must specify the destination container to which the object is to be moved.

MustSpecifyDnForIdentifierLookup

Must specify the distinguished name to retrieve the object reference property.

MustSpecifyInstanceInfoInTheHeader

Instance Information is not provided in the Request Header.

MustSpecifyNamespace

An object has been found with no qualifying namespace.

MustSpecifyNonnullAttrValue

An attribute value cannot be null.

MustSpecifyObjectClassForCreation

Must specify the object class of the new object that is to be created.

MustSpecifyObjectRefPropInTheHeader

No object reference property element is present in the request header.

MustSpecifyParentForCreation

Must specify the parent object under which the new object is to be created.

MustSpecifyRdnForCreation

Must specify a relative distinguished name (RDN) for the new object during object creation.

MustSpecifyRdnForRename

Must specify the relative distinguished name (RDN) to which the object is to be renamed.

NewExpirationTimeNotSpecified

New expiration time/duration for the enumeration context is not specified in the renew request.

NoAttrTypeAndValsPresentInTheBody

There are no AttributeTypeAndValues present in the body to operate on.

NoChangesPresentInTheBody

There are no Changes present in the body to operate on.

NoConnectionAvailable

No connection is currently available to process the requested operation.  This is typically a transient condition.

NoDCInstanceForGCSchemaLookup

No Domain Controller instance was found running on the system to look up schema for the Global Catalog instance.

NoDefaultNamingContextFoundForFilter

Default Naming Context could not be retrieved from the directory. Please specify filter for the enumerate request under such circumstances.

NoSuchEnumCtxGuidExists

Unknown or expired enumeration context.

NotCorrectFilterType

The supplied filter is of the wrong type.

NotificationSearchControlNotAllowed

Unsupported LDAP control.  The Notification Search (1.2.840.113556.1.4.528) and Shutdown Notify (1.2.840.113556.1.4.1907) controls are not supported.

ObjectCreatedButIdentityUnknown

The object was created but its object reference property could not be retrieved from the directory.

ObjectInWrongNamespace

The object is in the wrong namespace.

OperationTimeout

The operation timed-out.

PageSizeMustBeGreaterThanZero

The number of items to retrieve must be greater than zero.

PutOperationUnsupported

The Put 'Operation' is invalid for this operation, or is unrecognized.

ReservedConnectionInvalidated

The connection for processing this request is unavailable.  It may have been closed for being open or idle too long.

ScopeNodeNotOnelevelNorSubtreeNorBase

LdapQuery filter scope is not onelevel nor subtree nor base

ServerTimeMustBeNonNegative

The maximum duration for the Pull operation cannot be negative.

SessionsMismatch

Enumeration context belongs to a different principal.

SortKeyIsSpecialAttribute

Sort key on the specified directory attribute is not supported.

TooManySortKeySpecified

Too many sort keys were specified. Only one sort key is supported.

UnknownAttribute

The specified attribute {0} is unknown.

UnknownAttributeType

Unrecognized attribute found.

UnknownXmlNode

An unknown XML node was encountered and cannot be processed.

UnrecognizedDateAndTime

Expiration time does not correspond to any of the recognized datetime or duration format patterns.

UnrecognizedMaxElements

MaxElements does not correspond to valid xs:positiveInteger data type.

Second table:

A

B

EArgument

An ArgumentException was returned.

ECreate

A CreateException was returned.

EDirectoryOperation

A DirectoryOperationException was returned.

EEnumContextLimitExceeded

An EnumerationContextLimitExceededException was returned.

EInvalidExpression

An InvalidExpressionException was returned.

EInvalidModifyRequestSyntax

An InvalidModifyRequestSyntaxException was returned.

EInvalidOperation

An InvalidOperationException was returned.

EInvalidXml

An XmlException was returned.

ELdap

An LdapException was returned.

EModifyOperationUnsupported

An InvalidOperationException was returned.

ENoConnection

A NoConnectionAvailableException was returned.

EPut

A PutException was returned.

ESerialization

A SerializationException was returned.

EUnknownAttribute

An UnknownAttributeException was returned.

<10> Section 2.7: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements accessing any AD DS or AD LDS directory service impose the same limit on the maximum number of attribute values returned as the server version to which it is connected. Active Directory behavior for range retrieval and its imposed limits on values returned are defined in [MS-ADTS] section 3.1.1.3.1.3.3.

<11> Section 2.7.2: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements, when accessing any AD DS or AD LDS directory service, impose the same limit on the maximum number of attribute values returned as the server version to which it is connected. Active Directory behavior for range retrieval and its imposed limits on values returned are defined in [MS-ADTS] section 3.1.1.3.1.3.3.