Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 domains, each with 2 Domain Controllers:

  • company.local

Both domains are in the same forest and have a bi-direction trust setup. We're migrating to the at present, however having some issues with systems that need to query LDAP.

When doing an LDAP search against either Domain Controller in we get a referral to which is NOT under AD control:

$ ldapsearch -x -h 172.xx.xx.11 -b DC=company,DC=com,DC=au -D "" -W
Enter LDAP Password: 
# extended LDIF
# LDAPv3
# base <DC=company,DC=com,DC=au> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
# with manageDSAit control

# search result
search: 2
result: 10 Referral
text: 0000202B: RefErr: DSID-031007EF, data 0, 1 access points
    ref 1: 'company.'

ref: ldap://,DC=com,DC=au

# numResponses: 1

Note the referral points to which AD does NOT control -- the domain is and it is delegated by the nameservers to the 2 DC's.

Querying the Global Catalog on the same server gives us the results we expect.

So why would the Domain Controller for a domain not know about the domain in it's LDAP, while the GC does know?

share|improve this question
up vote 4 down vote accepted

Because you are specifying as the search base. If you want to query your domain local partition without getting a referral, use as your search base.

share|improve this answer
Oh my... 3 of us looked at this and none of us saw that. Thank-you for being our eyes, we'll go get them checked out at the optometrist now. – fukawi2 Mar 5 '14 at 22:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.