What causes "Active Directory search failed for '{ldapPath}': {exception.Message}" in BornToBeRoot/NETworkManager?

Verify the ldapPath DN is correct and the object exists (test with ldp.exe or AD Users and Computers)

BornToBeRoot/NETworkManager · error · InvalidOperationException

Active Directory search failed for

Error message

Active Directory search failed for '{ldapPath}': {exception.Message}

What it means

ActiveDirectoryComputerSearcher.GetComputersInSubtree performs an LDAP search against Active Directory via ADSI (COM). When the underlying COM call fails with a COMException, it is wrapped in an InvalidOperationException that includes the LDAP path and the COM error message, with the original exception as InnerException.

Solutions

Verify the ldapPath DN is correct and the object exists (test with ldp.exe or AD Users and Computers)
Check network connectivity to the domain controller on the LDAP port
Confirm the current user's credentials have read permission on the subtree
Inspect the InnerException COMException's ErrorCode for the specific ADSI failure (e.g. 0x80072030 no such object, 0x8007052E logon failure)

Example fix

// before
var computers = searcher.GetComputersInSubtree("LDAP://OU=Bogus,DC=contoso,DC=local");
// after
var ldapPath = "LDAP://OU=Computers,DC=contoso,DC=local";
using var entry = new System.DirectoryServices.DirectoryEntry(ldapPath);
_ = entry.Name; // validate path before searching
var computers = searcher.GetComputersInSubtree(ldapPath);

Defensive patterns

Strategy: try-catch

Validate before calling

using var probe = new System.DirectoryServices.DirectoryEntry(ldapPath);
try { _ = probe.Name; } catch (System.Runtime.InteropServices.COMException e) { /* path unreachable/invalid */ }

Type guard

bool LooksLikeLdapPath(string path) => path != null && path.StartsWith("LDAP://", StringComparison.OrdinalIgnoreCase) && path.Contains("DC=");

Try / catch

try { return searcher.GetComputersInSubtree(ldapPath); }
catch (InvalidOperationException ex) when (ex.InnerException is COMException ce) { log.Error($"AD search failed ({ce.ErrorCode}): {ce.Message}"); return []; }

Prevention

Test LDAP paths with ldp.exe before coding against them
Verify domain join and DC connectivity first
Use least-privilege service accounts with read access
Log the COMException ErrorCode for diagnosis

When it happens

Trigger: Calling GetComputersInSubtree with an ldapPath that is unreachable or invalid: nonexistent OU path, domain controller not resolvable, credentials lacking directory read rights, or AD services unavailable — all surfaced as COMException from the ADSI search.

Common situations: Typo in the LDAP path (e.g. 'LDAP://DC=contoso,DC=local' with a wrong DN), firewall blocking LDAP port 389/6389, machine not domain-joined, expired credentials, or the target OU was deleted.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

AI-assisted analysis of BornToBeRoot/NETworkManager@2780d65469 (2026-09-12). Data as JSON: /api/errors/3fcd7cafb8acd613. Report an issue: GitHub.

Appendix: source

Thrown at Source/NETworkManager.Utilities/ActiveDirectory/ActiveDirectoryComputerSearcher.cs:73

                var profileName = samAccountName.TrimEnd('$');
                if (string.IsNullOrWhiteSpace(profileName))
                    profileName = nameAttribute;

                if (string.IsNullOrWhiteSpace(profileName))
                    continue;

                computers.Add(new ActiveDirectoryComputerRecord(profileName.Trim(), dnsHostName, objectGuid));
            }

            computers.Sort((left, right) =>
                string.Compare(left.ProfileName, right.ProfileName, StringComparison.OrdinalIgnoreCase));

            return computers;
        }
        catch (COMException exception)
        {
            throw new InvalidOperationException(
                $"Active Directory search failed for '{ldapPath}': {exception.Message}",
                exception);
        }
    }

    /// <summary>
    ///     Creates and returns a <see cref="DirectoryEntry"/> bound to <paramref name="ldapPath"/>.
    ///     When <see cref="ActiveDirectorySearchOptions.Username"/> is empty the entry binds with
    ///     the current Windows identity; otherwise it uses explicit credentials with
    ///     <see cref="AuthenticationTypes.Secure"/> (plus <see cref="AuthenticationTypes.SecureSocketsLayer"/>
    ///     when SSL is requested).
    /// </summary>
    private static DirectoryEntry CreateDirectoryEntry(string ldapPath, ActiveDirectorySearchOptions options)
    {
        var authTypes = AuthenticationTypes.Secure;

        if (options.UseSsl)
            authTypes |= AuthenticationTypes.SecureSocketsLayer;

View on GitHub (pinned to 2780d65469)