Pierangelo Masarati wrote: > The fact that base scope searches for the empty DN return the rootDSE is > subjected to access checking, so the message you're suggesting sounds a > bit too optimistic (or simplistic). How about shorten it: "This does not affect search requests with base scope." Ciao, Michael.