Fix ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX (0X000020B9)

Active Directory sync or monitoring tool threw this because its LDAP notification filter is too nested or has too many objects. Usually a bad app config or over-ambitious query.

Quick Answer

Check which application registered the notification filter using repadmin /syncall /adsp, then simplify or remove the LDAP filter that has too many OR conditions or nested groups.

What's Going On Here?

This error pops up when an LDAP client (like a monitoring tool, sync engine, or backup agent) sets up a DirSync or notify filter that's just too complex for the domain controller to handle. The default limit in Windows Server 2016 and later is 500 objects in a single filter, but earlier versions cap it around 100. Last month a client had this because their helpdesk software was doing an LDAP query with 40 OR clauses for different OUs — the DC just gave up.

The error code 0X000020B9 means ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX. It's a server-side refusal, not a network issue. You'll see it in the Directory Service event log (event ID 4 or 5) or in your app's log.

Step-by-Step Fix

Find the culprit app — Run repadmin /syncall /adsp on a domain controller. Look for entries with NOTIFY in the output. That'll show you which account or tool registered the filter.
Check the event log — Open Event Viewer, go to Applications and Services Logs > Microsoft > Windows > Directory Service > Operational. Look for event ID 4 or 5. It usually includes the LDAP filter string.
Simplify the filter — If you find a filter like (&(objectClass=user)(|(ou=Sales)(ou=Engineering)(ou=...))) with 30+ OUs, split it into multiple smaller queries. Each filter should have no more than 100 OR terms.
Remove the filter if it's a misconfigured tool — In ADSI Edit, locate the CN=Notifications container under the configuration partition. Delete entries pointing to the offending app. Back up first.
Restart the service — After cleaning up, restart the app or the client-side service. On the DC, run repadmin /syncall /force to force replication.

When the Main Fix Doesn't Work

If you can't identify the filter source:

Increase the filter size limit — Not recommended, but on Server 2019+, you can add DsNotificationFilterLimit (DWORD) to HKLM\System\CurrentControlSet\Services\NTDS\Parameters. Set it to 2000 or higher. Reboot the DC. This is a band-aid, not a fix.
Check for third-party agents — Some backup tools like Veeam or CommVault set aggressive notifications. Uninstall or update them.
Review recent changes — Did someone add a ton of new OUs or groups? That can push the filter over the limit. Test by temporarily disabling the filter.

Prevention Tip

Don't let apps build dynamic LDAP filters with hundreds of OR clauses. If you're building a custom tool, use group membership checks instead of enumerating OUs. Also, monitor event ID 4 regularly — it'll catch this before users see sync failures.

Had a client last month whose entire print queue died because of this. Their print server was using an LDAP filter to pull users by department, and when IT added 120 departments overnight, the filter broke. Simplified it to a single group filter, problem gone.