Problems running LDAP query on 2008 R2 DC. The same one works on a 2003 DC

Question

If I run the following LDAP sentence on a 2008 R2 Domain Controller,

adoCommand.CommandText = "<LDAP://my2008DC.MyChild.MyPDC.com/CN=Enterprise Admins,CN=Users,DC=MyPDC,DC=com>;(&(objectCategory=group)(cn=*));cn;base"
Set adoRecordset = adoCommand.Execute

I get "a referral was returned from the server" error.

However if I run the same script on a 2003 DC, it runs fine.

Notice my2008DC is a global catalog in the MyChild.MyPDC.com domain, would have a partial copy of the MyPDC.com domain and therefore could query that server to find information about objects in MyPDC.com, am I right?

Any clues about why 2003 Domain Controllers are able to run it and 2008 DCs not?

Answer 1

From the servername I deduce that this is a DC for a child domain. You are asking for data about an entity in the parent domain and thus the referral.

You are querying AD here, not the global catalog so AD doesn't have the data. I would venture the guess that your win2k3 DC is in the parent domain.

Answer 2

You are clearly performing the search against the local domain partition, the Global Catalog would not return referrals

If you want to perform an LDAP search against the Global Catalog, specify port 3268, like this:

LDAP://my2008DC.MyChild.MyPDC.com:3268/...

See this TechNet article for further explanations and notes on the subject.