Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I run the following LDAP sentence on a 2008 R2 Domain Controller,

adoCommand.CommandText = "<LDAP://my2008DC.MyChild.MyPDC.com/CN=Enterprise Admins,CN=Users,DC=MyPDC,DC=com>;(&(objectCategory=group)(cn=*));cn;base"
Set adoRecordset = adoCommand.Execute

I get "a referral was returned from the server" error.

However if I run the same script on a 2003 DC, it runs fine.

Notice my2008DC is a global catalog in the MyChild.MyPDC.com domain, would have a partial copy of the MyPDC.com domain and therefore could query that server to find information about objects in MyPDC.com, am I right?

Any clues about why 2003 Domain Controllers are able to run it and 2008 DCs not?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

From the servername I deduce that this is a DC for a child domain. You are asking for data about an entity in the parent domain and thus the referral.

You are querying AD here, not the global catalog so AD doesn't have the data. I would venture the guess that your win2k3 DC is in the parent domain.

share|improve this answer

You are clearly performing the search against the local domain partition, the Global Catalog would not return referrals

If you want to perform an LDAP search against the Global Catalog, specify port 3268, like this:

LDAP://my2008DC.MyChild.MyPDC.com:3268/...

See this TechNet article for further explanations and notes on the subject.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.