Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I run the following LDAP sentence on a 2008 R2 Domain Controller,

adoCommand.CommandText = "<LDAP:// Admins,CN=Users,DC=MyPDC,DC=com>;(&(objectCategory=group)(cn=*));cn;base"
Set adoRecordset = adoCommand.Execute

I get "a referral was returned from the server" error.

However if I run the same script on a 2003 DC, it runs fine.

Notice my2008DC is a global catalog in the domain, would have a partial copy of the domain and therefore could query that server to find information about objects in, am I right?

Any clues about why 2003 Domain Controllers are able to run it and 2008 DCs not?

share|improve this question
up vote 1 down vote accepted

From the servername I deduce that this is a DC for a child domain. You are asking for data about an entity in the parent domain and thus the referral.

You are querying AD here, not the global catalog so AD doesn't have the data. I would venture the guess that your win2k3 DC is in the parent domain.

share|improve this answer

You are clearly performing the search against the local domain partition, the Global Catalog would not return referrals

If you want to perform an LDAP search against the Global Catalog, specify port 3268, like this:


See this TechNet article for further explanations and notes on the subject.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.