{"record":{"id":"3fcd7cafb8acd613","repo":"BornToBeRoot/NETworkManager","slug":"active-directory-search-failed-for-ldappath-exception","errorCode":null,"errorMessage":"Active Directory search failed for '{ldapPath}': {exception.Message}","messagePattern":"Active Directory search failed for '(.+?)': (.+?)","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"Source/NETworkManager.Utilities/ActiveDirectory/ActiveDirectoryComputerSearcher.cs","lineNumber":73,"sourceCode":"\n                var profileName = samAccountName.TrimEnd('$');\n                if (string.IsNullOrWhiteSpace(profileName))\n                    profileName = nameAttribute;\n\n                if (string.IsNullOrWhiteSpace(profileName))\n                    continue;\n\n                computers.Add(new ActiveDirectoryComputerRecord(profileName.Trim(), dnsHostName, objectGuid));\n            }\n\n            computers.Sort((left, right) =>\n                string.Compare(left.ProfileName, right.ProfileName, StringComparison.OrdinalIgnoreCase));\n\n            return computers;\n        }\n        catch (COMException exception)\n        {\n            throw new InvalidOperationException(\n                $\"Active Directory search failed for '{ldapPath}': {exception.Message}\",\n                exception);\n        }\n    }\n\n    /// <summary>\n    ///     Creates and returns a <see cref=\"DirectoryEntry\"/> bound to <paramref name=\"ldapPath\"/>.\n    ///     When <see cref=\"ActiveDirectorySearchOptions.Username\"/> is empty the entry binds with\n    ///     the current Windows identity; otherwise it uses explicit credentials with\n    ///     <see cref=\"AuthenticationTypes.Secure\"/> (plus <see cref=\"AuthenticationTypes.SecureSocketsLayer\"/>\n    ///     when SSL is requested).\n    /// </summary>\n    private static DirectoryEntry CreateDirectoryEntry(string ldapPath, ActiveDirectorySearchOptions options)\n    {\n        var authTypes = AuthenticationTypes.Secure;\n\n        if (options.UseSsl)\n            authTypes |= AuthenticationTypes.SecureSocketsLayer;","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/BornToBeRoot/NETworkManager/blob/2780d65469917a296dbc15f206107d72e2d0115c/Source/NETworkManager.Utilities/ActiveDirectory/ActiveDirectoryComputerSearcher.cs#L55-L91","documentation":"ActiveDirectoryComputerSearcher.GetComputersInSubtree performs an LDAP search against Active Directory via ADSI (COM). When the underlying COM call fails with a COMException, it is wrapped in an InvalidOperationException that includes the LDAP path and the COM error message, with the original exception as InnerException.","triggerScenarios":"Calling GetComputersInSubtree with an ldapPath that is unreachable or invalid: nonexistent OU path, domain controller not resolvable, credentials lacking directory read rights, or AD services unavailable — all surfaced as COMException from the ADSI search.","commonSituations":"Typo in the LDAP path (e.g. 'LDAP://DC=contoso,DC=local' with a wrong DN), firewall blocking LDAP port 389/6389, machine not domain-joined, expired credentials, or the target OU was deleted.","solutions":["Verify the ldapPath DN is correct and the object exists (test with ldp.exe or AD Users and Computers)","Check network connectivity to the domain controller on the LDAP port","Confirm the current user's credentials have read permission on the subtree","Inspect the InnerException COMException's ErrorCode for the specific ADSI failure (e.g. 0x80072030 no such object, 0x8007052E logon failure)"],"exampleFix":"// before\nvar computers = searcher.GetComputersInSubtree(\"LDAP://OU=Bogus,DC=contoso,DC=local\");\n// after\nvar ldapPath = \"LDAP://OU=Computers,DC=contoso,DC=local\";\nusing var entry = new System.DirectoryServices.DirectoryEntry(ldapPath);\n_ = entry.Name; // validate path before searching\nvar computers = searcher.GetComputersInSubtree(ldapPath);","handlingStrategy":"try-catch","validationCode":"using var probe = new System.DirectoryServices.DirectoryEntry(ldapPath);\ntry { _ = probe.Name; } catch (System.Runtime.InteropServices.COMException e) { /* path unreachable/invalid */ }","typeGuard":"bool LooksLikeLdapPath(string path) => path != null && path.StartsWith(\"LDAP://\", StringComparison.OrdinalIgnoreCase) && path.Contains(\"DC=\");","tryCatchPattern":"try { return searcher.GetComputersInSubtree(ldapPath); }\ncatch (InvalidOperationException ex) when (ex.InnerException is COMException ce) { log.Error($\"AD search failed ({ce.ErrorCode}): {ce.Message}\"); return []; }","preventionTips":["Test LDAP paths with ldp.exe before coding against them","Verify domain join and DC connectivity first","Use least-privilege service accounts with read access","Log the COMException ErrorCode for diagnosis"],"tags":["active-directory","ldap","network"],"backgroundTag":"api-request-failed","analyzedSha":"2780d65469917a296dbc15f206107d72e2d0115c","analyzedAt":"2026-09-12T17:00:17.986Z","contentChangedAt":"2026-09-12T17:00:17.986Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}