Overview [1]#

LDAP_SERVER_NOTIFICATION_OID is a Persistent Search Control as implemented within Microsoft Active Directory with an OID of 1.2.840.113556.1.4.528

The LDAP_SERVER_NOTIFICATION_OID control is used with an extended LDAP Asynchronous Operation search function to register the client to be notified when changes are made to an object in Microsoft Active Directory.

To use this control, set the members of the LDAPControl structure as follows:

struct berval ldctl_value = {0, NULL};
BOOLEAN ldctl_iscritical;


  • ldctl_oid - LDAP_SERVER_NOTIFICATION_OID, defined as "1.2.840.113556.1.4.528".
  • ldctl_value - No data for this control. In the berval structure, set bv_len to zero and bv_val to NULL.
  • ldctl_iscritical - Can be TRUE or FALSE depending on whether LDAP notification is critical to the application.


This control is used with an extended LDAP search function such as ldap_search_ext to register a change notification request of the directory objects that match the search filter specified. The control is part of the SearchRequest and SearchResultDone messages in the control fields of LDAPMessage. A client can register up to five (5) notification requests with this control.

Notifications are Asynchronous Operations. The server sends SearchEntry responses, that contain the modified objects, to the client using the LDAPMessage ID of the original notification request. Notifications from this control may be canceled using the ldap_abandon function. For more information about Notifications in Active Directory, see Change Notifications in Active Directory.

Limitations of the Server Notification Control include:

  • The filter, (objectclass = *), is the only filter allowed on a persistent search.
  • Base, one-level, and subtree searches are allowed, but subtree searches must be rooted on a Naming Context.
Using a filter other than (objectclass =*) and attempting a subtree level search on a container that is not the root of a Naming Context will return the UnwillingToPerform (53) error message.

The user application must have the proper directory service access rights to successfully use this control. The user application must have permission to read the objects that fall within the scope of the search function using this control. Any object that is not accessed with the proper permission will NOT generate a change notification when its contents are modified.


More Information#

There might be more information for this subject on one of the following:

Add new attachment

Only authorized users are allowed to upload new attachments.
« This page (revision-1) was last changed on 14-Sep-2017 08:33 by jim