SelfADSI - The LDAP / ADSI Scripting Tutorial
ADSI Error Codes and Runtime Error Handling

ADO_UNSPECIFIED

This number doesn't indicate a specific reason for this error but will always occur if there are problems in ADO requests, e.g. you forgot to pass the search scope (Subtree, OneLevel etc.) wihtin your request string.

This error can occur eben without using ADO when you have a type mismatch while writing an object attribut (for example if you use the ADSI method Put() to fill an integer or string attribute ith a floating point number). In this case you better convert the value into a string first.

ADS_BAD_PATHNAME

This error occurs when the indicated LDAP path of LDAP BIND requests on objects or ADODB requests are invalid. Maybe you tried to access a nonexisting object with a GetObject() call or there was a typing error in the distinguished name of the demanded object.

You can get more information about this in the following SelfADSI tutorial topic: "LDAP Pathnames - Distinguished Names".

ADS_BAD_PARAMETER

There are different reasons for this error: One of the parameters used in an ADSI function is invalid - regarding either the data type or logic. The error occurs e.g. during a call with the ADSI function Delete() for an object when the indicated object class was incorrect. Or when no array was used as first parameter for a GetInfoEx() call.

ADS_TYPE_CANNOT_BE_CONVERTED

This error occurs when you try to access a provider specific attribute without using the neccessary technics. Some directory services return the values for its attributes in this strange syntax format. Instead of using the normal access methods like Get() and GetEx(), you have to use the ADSI-Function GetPropertyItem().

You can find a description of the access methods for provider specific attributes in the SelfADSI tutorial under the topic "Provider Specific Attributes".

ADS_PROPERTY_NOT_FOUND

This error will occur if you try to access attributes that aren't located in the so-called property cache. This cache has been built up with the functions GetObject, GetInfo or GetInfoEx. It could also be an operational attribute that isn't automatically built in the cache but has to be requested explicitly from the directory. Or there is a simple typing error in the specification of the attribute.

ADO_PERMISSION_DENIED

An ADO call failed because the user account used for a directory BIND authentication had no appropriate permissions.

ADO_INVALID_SEARCH_FILTER_SYNTAX

This error may occur when trying to perform an ADODB search in the directory. This search fails when the used ADO searchstring is syntactically incorrect. This have to be considered not only for the LDAP filter which is part of the ADO command string. If you have any syntax errors in your command string, you will encounter this error code.

ADO_SEARCH_TABLE_DOES_NOT_EXIST

This error can occur when trying to perform an ADODB search in the directory. It fails when the specified LDAP server is unreachable or the passed LDAP path in which objects are searched is nonexisting. But there are LDAP server (e.g. Novell NetWare) that return this error code when the user ID used in the ADO request doesn't exist!

ADS_INSUFFICIENT_RIGHTS

An ADSI call failed because the user account used for a directory BIND authentication hadn't enough permissions.

LDAP_OTHER

An unspecific error that may have many different reasons. Often this error occurs when trying to nest AD groups in other groups without considering the group scope (global groups may contain groups of other domains; local domain groups can't be nested in groups from other domains etc.)

This error can also occur during the creation of AD objects when special characters (like e.g. \ / = , etc.) occur or rather aren't coded correctly within the relative distinguished name or in other name attributes.

LDAP_INVALID_CREDENTIALS

This error will occur if the passed user name during a BIND authentication in the directory is nonexisting or if the password is invalid . It may also be that the server doesn't allow simple cleartext authentication.

LDAP_ALREADY_EXISTS

This error occurs when the ADSI method Create() is applied to a container object whose distinguished name for the object you want to create does already exist.

LDAP_NO_SUCH_ATTRIBUTE

This error occurs when trying to read a nonexisting attribute in the property cache of an object with the ADSI function GetInfoEx().

LDAP_ATTRIBUTE_OR_VALUE_EXISTS

This error occurs primarily when you try to add members to groups that have been members of this group beforehand.

0x80072016

LDAP_NOT_ALLOWED_ON_RDN

This error will occur if you want to change the relative distinguished name of an object but this operation, however, is not allowed by the directory server. Alternatively, you could try to rename the respective object with the ADSI move function.

0x80072021

LDAP_PROTOCOL_ERROR

This error occurs e.g. when passing the wrong data type while writing attributes. There are several attributes existing that require a distinguished name. If you pass a simple string in the put method it will come to this error code.

0x8007202b

LDAP_REFERRAL

This error code occurs e.g. when passing an incorrect distinguished name in the OpenDSObject method of a Windows 2000 ADS. Especially, when the name of the naming context is incorrect (i.e. for example the specification of an invalid domain name).

LDAP_CONSTRAINT_VIOLATION

An internal requirement of the directory service wasn't fulfilled. Maybe it was tried to create an Exchange mailbox with an indefinite SMTP address. Or it was tried to create an ADS user object that doesn't have a login name.

Another example: There are attributes that must contain the distinguished name of another directory object (e.g. in recipient redirections of mailboxes). The constraint violations appears when trying to write any text in such an attribute.

Another possibility is that it was tried to nest groups within a mixed mode environment but what is imposssible here.

LDAP_NO_SUCH_OBJECT

This error is similar to ADS_BAD_PATHNAME (0x80005008) - during the BIND process, an LDAP object path was passed from a nonexisting object. The pecularity with this issue is that the error code ADS_BAD_PATHNAME is always given back in ADS environments, whereas other LDAP server (e.g. Novell eDirectory environments) return LDAP_No_SUCH-OBJECT.

LDAP_INVALID_DN_SYNTAX

This error occurs when a distinguished name used for the creation of objects contains invalid characters.

LDAP_UNWILLING_TO_PERFORM

The LDAP server rejects to perform the requested operation. This error code occurs when trying to change the password of a an ADS user via ADSI but with the password not complying with the demands of the domain policies (i.e. it is too short, too simple or used earlier). Or attributes are tried to change which can only be change by the security account manager (e.g. lastLogon).

This error also occurs in the context of ADS schema manipulations. Either it wasn't allowed to change the schema or the schema master domain controller wasn't reachable, or another schema extension was active.

LDAP_NAMING_VIOLATION

This error occurs in the context of the creation of objects or the access to their attributes. The reason is the usage of an invalid LDAP path, e.g. when you want to create an organizational unit with description cn=.... .

LDAP_SERVER_DOWN

This error code occurs when the addressed server is unreachable during a BIND authentication in the directory. This can occur due to underlying network problems. A firewall may block the used LDAP port, or the LDAP service isn't active on the destination host.

METHOD_OR_PROPERTY_NOT_SUPPORTED

This error occurs in LDAP and directory scripting for example when you try to directly access an object attribute with the syntax "objectname.attributename". If you misspell the attribute name, you get this errorcode. The errorcode means that the given attribute doesnt exists for that particular object class.

You can find a description of the access methods for object attributes in the SelfADSI tutorial under the topics "Reading object attributes" and "Writing object attributes".

On Error Resume Next

Err.Clear
Set user = GetObjekt("LDAP://everest.himalay.net/cn=Michael Sandt,ou=Consultants,dc=himalaya,dc=net"
If (Err.number <> 0) Then
    WScript.Echo "Error: " & Err.Number
    WScript.Echo Err.Descritption
    Wscript.Quit 2
End If

user.DisplayName = "Michael Sandt (Vancouver)" 
Err.Clear
user.Setinfo
If (Err.number <> 0) Then
    WScript.Echo "Error: Attribute could not be written"
    Wscript.Quit 3
End If