5 Appendix A: Product Behavior
The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include updates to those products.
The terms "earlier" and "later", when used with a product version, refer to either all preceding versions or all subsequent versions, respectively. The term "through" refers to the inclusive range of versions. Applicable Microsoft products are listed chronologically in this section.
Windows Server 2008 R2 operating system
Windows Server 2012 operating system
Windows Server 2012 R2 operating system
Windows Server 2016 operating system
Windows Server operating system
Windows Server 2019 operating system
Windows Server 2022 operating system
Windows Server 2025 operating system
Exceptions, if any, are noted in this section. If an update version, service pack or Knowledge Base (KB) number appears with a product name, the behavior changed in that update. The new behavior also applies to subsequent updates unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.
Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms "SHOULD" or "SHOULD NOT" implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term "MAY" implies that the product does not follow the prescription.
<1> Section 1.3: The following products are applicable to Active Directory Web Services: Data Model and Common Elements:
Active Directory Management Gateway Service contains the server implementation of the ADWS set of protocols that use Active Directory Web Services: Data Model and Common Elements.
Remote Server Administration Tools (excluding Remote Server Administration Tools for Windows Vista operating system) contains the client implementation. For more information about Remote Server Administration Tools, see [MSFT-RSAT].
Windows Server 2008 R2 and later contain both the server and the client implementations.
Active Directory Management Gateway Service is available for Windows Server 2003 operating system with Service Pack 2 (SP2), Windows Server 2003 R2 operating system with Service Pack 2 (SP2), and Windows Server 2008 operating system.
<2> Section 2.3.3.1: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements do not return the ad:objectReferenceProperty synthetic attribute if the requestor does not have permission to read O!objectGUID, where O is the directory object being represented as an XML view.
<3> Section 2.3.3.2: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements in Active Directory Management Gateway Service for Windows Server 2003 operating system omits this attribute from the XML view of all directory objects, regardless of whether the directory object has a parent.
<4> Section 2.3.4: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements use the following mapping between rootDse attributes (specified by their LDAP display names) and XML syntaxes.
rootDse attribute name |
LDAPSYN |
XML syntax (XMLSYN) |
---|---|---|
configurationnamingcontext |
DSDNString |
xsd:string |
Currenttime |
GeneralizedTimeString |
xsd:string |
defaultnamingcontext |
DSDNString |
xsd:string |
Dnshostname |
UnicodeString |
xsd:string |
Dsschemaattrcount |
Integer |
xsd:string |
Dsschemaclasscount |
Integer |
xsd:string |
dsschemaprefixcount |
Integer |
xsd:string |
Dsservicename |
DSDNString |
xsd:string |
highestcommittedusn |
LargeInteger |
xsd:string |
Isglobalcatalogready |
Boolean |
xsd:string |
Issynchronized |
Boolean |
xsd:string |
Ldapservicename |
UnicodeString |
xsd:string |
Namingcontexts |
DSDNString |
xsd:string |
pendingpropagations |
DSDNString |
xsd:string |
rootdomainnamingcontext |
DSDNString |
xsd:string |
schemanamingcontext |
DSDNString |
xsd:string |
Servername |
DSDNString |
xsd:string |
Subschemasubentry |
DSDNString |
xsd:string |
supportedcapabilities |
ObjectIdentifier |
xsd:string |
Supportedcontrol |
ObjectIdentifier |
xsd:string |
supportedldappolicies |
UnicodeString |
xsd:string |
supportedldapversion |
Integer |
xsd:string |
supportedsaslmechanisms |
UnicodeString |
xsd:string |
domaincontrollerfunctionality |
Integer |
xsd:string |
Domainfunctionality |
Integer |
xsd:string |
Forestfunctionality |
Integer |
xsd:string |
msds-replallinboundneighbors |
UnicodeString |
xsd:string |
msds-replalloutboundneighbors |
UnicodeString |
xsd:string |
msds-replconnectionfailures |
UnicodeString |
xsd:string |
msds-repllinkfailures |
UnicodeString |
xsd:string |
msds-replpendingops |
UnicodeString |
xsd:string |
msds-replqueuestatistics |
UnicodeString |
xsd:string |
msds-topquotausage |
UnicodeString |
xsd:string |
supportedconfigurablesettings |
UnicodeString |
xsd:string |
Supportedextension |
ObjectIdentifier |
xsd:string |
Validfsmos |
DSDNString |
xsd:string |
Dsaversionstring |
UnicodeString |
xsd:string |
msds-portldap |
Integer |
xsd:string |
msds-portssl |
Integer |
xsd:string |
msds-principalname |
UnicodeString |
xsd:string |
Serviceaccountinfo |
UnicodeString |
xsd:string |
Spnregistrationresult |
Integer |
xsd:string |
Tokengroups |
SidString |
xsd:base64Binary |
Usnatrifm |
LargeInteger |
xsd:string |
becomePdcWithCheckPoint |
SidString |
xsd:base64Binary |
checkPhantoms |
UnicodeString |
xsd:string |
doGarbageCollection |
Integer |
xsd:string |
dumpDatabase |
UnicodeString |
xsd:string |
fixupInheritance |
UnicodeString |
xsd:string |
invalidateRidPool |
SidString |
xsd:base64Binary |
recalcHierarchy |
UnicodeString |
xsd:string |
schemaUpdateNow |
UnicodeString |
xsd:string |
removeLingeringObject |
UnicodeString |
xsd:string |
doLinkCleanup |
UnicodeString |
xsd:string |
doOnlineDefrag |
Integer |
xsd:string |
replicateSingleObject |
UnicodeString |
xsd:string |
updateCachedMemberships |
UnicodeString |
xsd:string |
doGarbageCollectionPhantomsNow |
Integer |
xsd:string |
invalidateGCConnection |
UnicodeString |
xsd:string |
renewServerCertificate |
UnicodeString |
xsd:string |
rODCPurgeAccount |
UnicodeString |
xsd:string |
sqmRunOnce |
UnicodeString |
xsd:string |
runProtectAdminGroupsTask |
UnicodeString |
xsd:string |
<5> Section 2.5.1: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements provide access to any Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) directory service that is running on the same computer as ADWS. AD DS can be accessed via "ldap:389". If the machine is also an AD DS global catalog, then the global catalog can be accessed as "ldap:3268". An AD LDS instance can be accessed as "ldap:N", where N is the LDAP port number that the AD LDS instance has been configured to use.
<6> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements include both ad:FaultDetail/ad:Error and ad:FaultDetail/ad:ShortError elements.
<7> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements use ad:FaultDetail/ad:ArgumentError to indicate that an invalid argument was passed from one internal function to another.
Element |
Contents |
---|---|
ad:FaultDetail/ad:ArgumentError/ad:Message |
A human-readable error message string explaining the nature of the argument error that occurred. |
ad:FaultDetail/ad:ArgumentError/ad:ParameterName |
The name of the function parameter whose argument was invalid. |
<8> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements translate LDAP error codes to Win32 error codes ([MS-ERREF] section 2.2) using the following table.
LDAP Error |
Win32 Error |
||
---|---|---|---|
Code (Hex) |
Name |
Code (Dec) |
Name |
0x00 |
LDAP_SUCCESS |
0 |
NO_ERROR |
0x01 |
LDAP_OPERATIONS_ERROR |
8224 |
ERROR_DS_OPERATIONS_ERROR |
0x02 |
LDAP_PROTOCOL_ERROR |
8225 |
ERROR_DS_PROTOCOL_ERROR |
0x03 |
LDAP_TIMELIMIT_EXCEEDED |
8226 |
ERROR_DS_TIMELIMIT_EXCEEDED |
0x04 |
LDAP_SIZELIMIT_EXCEEDED |
8227 |
ERROR_DS_SIZELIMIT_EXCEEDED |
0x05 |
LDAP_COMPARE_FALSE |
8229 |
ERROR_DS_COMPARE_FALSE |
0x06 |
LDAP_COMPARE_TRUE |
8230 |
ERROR_DS_COMPARE_TRUE |
0x07 |
LDAP_AUTH_METHOD_NOT_SUPPORTED |
8231 |
ERROR_DS_AUTH_METHOD_NOT_SUPPORTED |
0x08 |
LDAP_STRONG_AUTH_REQUIRED |
8232 |
ERROR_DS_STRONG_AUTH_REQUIRED |
0x09 |
LDAP_PARTIAL_RESULTS |
299 |
ERROR_PARTIAL_COPY |
0x0a |
LDAP_REFERRAL |
8235 |
ERROR_DS_REFERRAL |
0x0b |
LDAP_ADMIN_LIMIT_EXCEEDED |
8228 |
ERROR_DS_ADMIN_LIMIT_EXCEEDED |
0x0c |
LDAP_UNAVAILABLE_CRIT_EXTENSION |
8236 |
ERROR_DS_UNAVAILABLE_CRIT_EXTENSION |
0x0d |
LDAP_CONFIDENTIALITY_REQUIRED |
8237 |
ERROR_DS_CONFIDENTIALITY_REQUIRED |
0x0e |
LDAP_SASL_BIND_IN_PROGRESS |
590610 |
SEC_I_CONTINUE_NEEDED |
0x10 |
LDAP_NO_SUCH_ATTRIBUTE |
8202 |
ERROR_DS_NO_ATTRIBUTE_OR_VALUE |
0x11 |
LDAP_UNDEFINED_TYPE |
8204 |
ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED |
0x12 |
LDAP_INAPPROPRIATE_MATCHING |
8238 |
ERROR_DS_INAPPROPRIATE_MATCHING |
0x13 |
LDAP_CONSTRAINT_VIOLATION |
8239 |
ERROR_DS_CONSTRAINT_VIOLATION |
0x14 |
LDAP_ATTRIBUTE_OR_VALUE_EXISTS |
8205 |
ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS |
0x15 |
LDAP_INVALID_SYNTAX |
8203 |
ERROR_DS_INVALID_ATTRIBUTE_SYNTAX |
0x20 |
LDAP_NO_SUCH_OBJECT |
8240 |
ERROR_DS_NO_SUCH_OBJECT |
0x21 |
LDAP_ALIAS_PROBLEM |
8241 |
ERROR_DS_ALIAS_PROBLEM |
0x22 |
LDAP_INVALID_DN_SYNTAX |
8242 |
ERROR_DS_INVALID_DN_SYNTAX |
0x23 |
LDAP_IS_LEAF |
8243 |
ERROR_DS_IS_LEAF |
0x24 |
LDAP_ALIAS_DEREF_PROBLEM |
8244 |
ERROR_DS_ALIAS_DEREF_PROBLEM |
0x30 |
LDAP_INAPPROPRIATE_AUTH |
8233 |
ERROR_DS_INAPPROPRIATE_AUTH |
0x31 |
LDAP_INVALID_CREDENTIALS |
1326 |
ERROR_LOGON_FAILURE |
0x32 |
LDAP_INSUFFICIENT_RIGHTS |
5 |
ERROR_ACCESS_DENIED |
0x33 |
LDAP_BUSY |
8206 |
ERROR_DS_BUSY |
0x34 |
LDAP_UNAVAILABLE |
8207 |
ERROR_DS_UNAVAILABLE |
0x35 |
LDAP_UNWILLING_TO_PERFORM |
8245 |
ERROR_DS_UNWILLING_TO_PERFORM |
0x36 |
LDAP_LOOP_DETECT |
8246 |
ERROR_DS_LOOP_DETECT |
0x3C |
LDAP_SORT_CONTROL_MISSING |
8261 |
ERROR_DS_SORT_CONTROL_MISSING |
0x3D |
LDAP_OFFSET_RANGE_ERROR |
8262 |
ERROR_DS_OFFSET_RANGE_ERROR |
0x40 |
LDAP_NAMING_VIOLATION |
8247 |
ERROR_DS_NAMING_VIOLATION |
0x41 |
LDAP_OBJECT_CLASS_VIOLATION |
8212 |
ERROR_DS_OBJ_CLASS_VIOLATION |
0x42 |
LDAP_NOT_ALLOWED_ON_NONLEAF |
8213 |
ERROR_DS_CANT_ON_NON_LEAF |
0x43 |
LDAP_NOT_ALLOWED_ON_RDN |
8214 |
ERROR_DS_CANT_ON_RDN |
0x44 |
LDAP_ALREADY_EXISTS |
5010 |
ERROR_OBJECT_ALREADY_EXISTS |
0x45 |
LDAP_NO_OBJECT_CLASS_MODS |
8215 |
ERROR_DS_CANT_MOD_OBJ_CLASS |
0x46 |
LDAP_RESULTS_TOO_LARGE |
8248 |
ERROR_DS_OBJECT_RESULTS_TOO_LARGE |
0x47 |
LDAP_AFFECTS_MULTIPLE_DSAS |
8249 |
ERROR_DS_AFFECTS_MULTIPLE_DSAS |
0x4c |
LDAP_VIRTUAL_LIST_VIEW_ERROR |
8341 |
ERROR_DS_GENERIC_ERROR |
0x50 |
LDAP_OTHER |
31 |
ERROR_GEN_FAILURE |
0x51 |
LDAP_SERVER_DOWN |
8250 |
ERROR_DS_SERVER_DOWN |
0x52 |
LDAP_LOCAL_ERROR |
8251 |
ERROR_DS_LOCAL_ERROR |
0x53 |
LDAP_ENCODING_ERROR |
8252 |
ERROR_DS_ENCODING_ERROR |
0x54 |
LDAP_DECODING_ERROR |
8253 |
ERROR_DS_DECODING_ERROR |
0x55 |
LDAP_TIMEOUT |
1460 |
ERROR_TIMEOUT |
0x56 |
LDAP_AUTH_UNKNOWN |
8234 |
ERROR_DS_AUTH_UNKNOWN |
0x57 |
LDAP_FILTER_ERROR |
8254 |
ERROR_DS_FILTER_UNKNOWN |
0x58 |
LDAP_USER_CANCELLED |
1223 |
ERROR_CANCELLED |
0x59 |
LDAP_PARAM_ERROR |
8255 |
ERROR_DS_PARAM_ERROR |
0x5a |
LDAP_NO_MEMORY |
8 |
ERROR_NOT_ENOUGH_MEMORY |
0x5b |
LDAP_CONNECT_ERROR |
1225 |
ERROR_CONNECTION_REFUSED |
0x5c |
LDAP_NOT_SUPPORTED |
8256 |
ERROR_DS_NOT_SUPPORTED |
0x5e |
LDAP_NO_RESULTS_RETURNED |
8257 |
ERROR_DS_NO_RESULTS_RETURNED |
0x5d |
LDAP_CONTROL_NOT_FOUND |
8258 |
ERROR_DS_CONTROL_NOT_FOUND |
0x5f |
LDAP_MORE_RESULTS_TO_RETURN |
234 |
ERROR_MORE_DATA |
0x60 |
LDAP_CLIENT_LOOP |
8259 |
ERROR_DS_CLIENT_LOOP |
0x61 |
LDAP_REFERRAL_LIMIT_EXCEEDED |
8260 |
ERROR_DS_REFERRAL_LIMIT_EXCEEDED |
<9> Section 2.6: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements attempt to find the ad:Message value in column B of the first table shown below.
If the value is found in column B of the first table, the ad:ShortMessage is populated with text from column A.
If no match is found in column B of the first table, ad:ShortMessage is populated from column A of the second table based on the error encountered, as described in column B.
First table:
A |
B |
---|---|
AnonymousNotAllowed |
Anonymous access to the directory is not permitted. |
AttributeValueNotaObjRef |
The attribute found is not a valid object reference (neither a GUID nor a string DN). |
AttributeValueNotaString |
The attribute found is not a String. |
AttributeValueNotByteOrStringOrGuid |
The attribute found is not a String, byte[] or GUID. |
BadPutOrCreateValue |
A Create or Put operation is being attempted with a bad value or values. |
BadValue |
An update is being attempted with an bad value. |
BadValueForRangeHigh |
Bad value has been specified for RangeHigh attribute. |
BadValueForRangeLow |
Bad value has been specified for RangeLow attribute. |
CanOnlyReplaceParentObjectRefForUpdate |
The parent object identity can only be replaced, not removed or added. |
CanOnlyReplaceRdnForUpdate |
The relative distinguished name (RDN) can only be replaced, not removed or added. |
CantSetDistinguishedNameForCreate |
The distinguished name attribute cannot be set during object creation. It is automatically set based on the relative distinguished name (RDN) and the parent object. |
CantSetDistinguishedNameForUpdate |
The distinguished name attribute cannot be updated. It is generated from the object's relative distinguished name (RDN) and the parent object. |
CantSetObjectRefPropertyForCreate |
The object reference property attribute cannot be set during object creation. It is automatically assigned by the directory. |
CantSetObjectRefPropertyForUpdate |
The object reference property attribute cannot be changed. It is automatically assigned by the directory at object creation. |
CouldntFindObjectForMove |
The object could not be found in the directory. |
CouldntFindParentObjectForCreation |
The parent object under which the new object is to be created could not be found in the directory. |
CouldntRetrieveRootDSEForFilter |
The RootDSE could not be retrieved from the directory. Please specify filter for the enumerate request under such circumstances. |
CreateMissingValues |
An AttributeTypeAndValue element in the Create operation did not contain any AttributeValue elements. |
DuplicateAttributeWithValues |
The attribute was found more than once, and has values. |
DuplicateEnumerationCacheEntry |
The EnumerationCacheEntry is a duplicate entry. |
EmptyAttribute |
The attribute has no value. |
EmptyCreate |
The Create operation did not contain any AttributeTypeAndValue elements. |
EmptyPut |
The Put operation did not contain any Change elements. |
EnumContextAbsentInTheRequest |
Request must specify the enumeration context. |
ErrorWhileFetchingAttributeValues |
Error while retrieving values for attribute {0} from the directory. |
ImpersonationLevelNotSetToImpersonate |
Impersonation level not set to Impersonate or higher by caller |
InvalidBase64Binary |
The base64Binary value len is not 4, or a multiple of 4. |
InvalidDnWithStringBinaryAccessPointValue |
The DN-with-binary, DN-with-string, or access-point value is in an invalid format. |
InvalidEnumerationCacheEntry |
The EnumerationCacheEntry is invalid. |
InvalidObjectReferenceProperty |
The supplied object reference property is not valid. |
InvalidParentObjectRefForCreateAndUpdate |
A single value must be specified for container-hierarchy-parent attribute. |
InvalidPredicate |
An update was specified with an invalid predicate. |
InvalidPutSyntax |
There is a mismatch between Put 'Operation' and the presence of an AttributeValue element |
MaxEnumCtxsTotalReached |
The maximum allowed number of enumeration contexts has been reached. |
MissingDialect |
Dialect not specified in the request. |
MissingExpression |
A create or update is missing an attribute. |
MissingLowerRange |
RangeLow attribute must be specified on the element with range qualifier. |
MissingOrMultipleBaseObjectNodes |
LdapQuery filter has a missing or multiple baseobject nodes |
MissingOrMultipleFilterNodes |
LdapQuery filter has a missing or multiple filter nodes |
MissingOrMultipleScopeNodes |
LdapQuery filter has a missing or multiple scope nodes |
MissingScopeOrBaseObjectOrFilterNode |
LdapQuery is missing the Scope, BaseObject or Filter node |
MissingSelectionDialect |
Selection dialect not specified in the request. |
MissingSortingDialect |
Sorting dialect not specified in the request. |
MissingTypeAttribute |
The attribute type is missing. |
MissingValue |
A create is missing the value for an attribute. |
MustSpecifyBaseDnForQuery |
Distinguished name search base must be supplied in the LdapQuery element. |
MustSpecifyContainerForMove |
Must specify the destination container to which the object is to be moved. |
MustSpecifyDnForIdentifierLookup |
Must specify the distinguished name to retrieve the object reference property. |
MustSpecifyInstanceInfoInTheHeader |
Instance Information is not provided in the Request Header. |
MustSpecifyNamespace |
An object has been found with no qualifying namespace. |
MustSpecifyNonnullAttrValue |
An attribute value cannot be null. |
MustSpecifyObjectClassForCreation |
Must specify the object class of the new object that is to be created. |
MustSpecifyObjectRefPropInTheHeader |
No object reference property element is present in the request header. |
MustSpecifyParentForCreation |
Must specify the parent object under which the new object is to be created. |
MustSpecifyRdnForCreation |
Must specify a relative distinguished name (RDN) for the new object during object creation. |
MustSpecifyRdnForRename |
Must specify the relative distinguished name (RDN) to which the object is to be renamed. |
NewExpirationTimeNotSpecified |
New expiration time/duration for the enumeration context is not specified in the renew request. |
NoAttrTypeAndValsPresentInTheBody |
There are no AttributeTypeAndValues present in the body to operate on. |
NoChangesPresentInTheBody |
There are no Changes present in the body to operate on. |
NoConnectionAvailable |
No connection is currently available to process the requested operation. This is typically a transient condition. |
NoDCInstanceForGCSchemaLookup |
No Domain Controller instance was found running on the system to look up schema for the Global Catalog instance. |
NoDefaultNamingContextFoundForFilter |
Default Naming Context could not be retrieved from the directory. Please specify filter for the enumerate request under such circumstances. |
NoSuchEnumCtxGuidExists |
Unknown or expired enumeration context. |
NotCorrectFilterType |
The supplied filter is of the wrong type. |
NotificationSearchControlNotAllowed |
Unsupported LDAP control. The Notification Search (1.2.840.113556.1.4.528) and Shutdown Notify (1.2.840.113556.1.4.1907) controls are not supported. |
ObjectCreatedButIdentityUnknown |
The object was created but its object reference property could not be retrieved from the directory. |
ObjectInWrongNamespace |
The object is in the wrong namespace. |
OperationTimeout |
The operation timed-out. |
PageSizeMustBeGreaterThanZero |
The number of items to retrieve must be greater than zero. |
PutOperationUnsupported |
The Put 'Operation' is invalid for this operation, or is unrecognized. |
ReservedConnectionInvalidated |
The connection for processing this request is unavailable. It may have been closed for being open or idle too long. |
ScopeNodeNotOnelevelNorSubtreeNorBase |
LdapQuery filter scope is not onelevel nor subtree nor base |
ServerTimeMustBeNonNegative |
The maximum duration for the Pull operation cannot be negative. |
SessionsMismatch |
Enumeration context belongs to a different principal. |
SortKeyIsSpecialAttribute |
Sort key on the specified directory attribute is not supported. |
TooManySortKeySpecified |
Too many sort keys were specified. Only one sort key is supported. |
UnknownAttribute |
The specified attribute {0} is unknown. |
UnknownAttributeType |
Unrecognized attribute found. |
UnknownXmlNode |
An unknown XML node was encountered and cannot be processed. |
UnrecognizedDateAndTime |
Expiration time does not correspond to any of the recognized datetime or duration format patterns. |
UnrecognizedMaxElements |
MaxElements does not correspond to valid xs:positiveInteger data type. |
Second table:
A |
B |
---|---|
EArgument |
An ArgumentException was returned. |
ECreate |
A CreateException was returned. |
EDirectoryOperation |
A DirectoryOperationException was returned. |
EEnumContextLimitExceeded |
An EnumerationContextLimitExceededException was returned. |
EInvalidExpression |
An InvalidExpressionException was returned. |
EInvalidModifyRequestSyntax |
An InvalidModifyRequestSyntaxException was returned. |
EInvalidOperation |
An InvalidOperationException was returned. |
EInvalidXml |
An XmlException was returned. |
ELdap |
An LdapException was returned. |
EModifyOperationUnsupported |
An InvalidOperationException was returned. |
ENoConnection |
A NoConnectionAvailableException was returned. |
EPut |
A PutException was returned. |
ESerialization |
A SerializationException was returned. |
EUnknownAttribute |
An UnknownAttributeException was returned. |
<10> Section 2.7: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements accessing any AD DS or AD LDS directory service impose the same limit on the maximum number of attribute values returned as the server version to which it is connected. Active Directory behavior for range retrieval and its imposed limits on values returned are defined in [MS-ADTS] section 3.1.1.3.1.3.3.
<11> Section 2.7.2: Microsoft implementations of Active Directory Web Services: Data Model and Common Elements, when accessing any AD DS or AD LDS directory service, impose the same limit on the maximum number of attribute values returned as the server version to which it is connected. Active Directory behavior for range retrieval and its imposed limits on values returned are defined in [MS-ADTS] section 3.1.1.3.1.3.3.