Apart from the HRESULT values, several ADSI system providers (mostly LDAP, but also NDS and NWCOMPAT) return additional error information for all operations performed by the following interfaces:
A part of such extended error information is the string sent by the server as a part of the message result.
Call ADsGetLastError to retrieve such extended error messages. The first parameter of this function, lpError, is a DWORD value. For an Active Directory® server, ADSI attempts to map an LDAP error message to an appropriate Win32 error code and assigns the Win32 error code value to lpError. Failing to resolve the mapping, ADSI assigns ERROR_INVALID_DATA to lpError, as it does for any other directory server. In all the cases, ADSI faithfully relays the string of the error description from the server to the client through lpErrorBuf, the second parameter of the ADsGetLastError function.