Fix ERROR_DS_UNICODEPWD_NOT_IN_QUOTES (0X0000216C)

Quick answer: Wrap the password in double quotes when setting the unicodePwd attribute via LDAP. For example: "P@ssw0rd" (including the quotes in the value).

Why you get this error

This error shows up when you're trying to reset a user's password through LDAP in Active Directory. The unicodePwd attribute is special — it's not like regular attributes. Microsoft designed it so the password value must be enclosed in double quotes. No exceptions. If you pass the password as plain text without quotes, the Directory Service throws ERROR_DS_UNICODEPWD_NOT_IN_QUOTES (0X0000216C).

I see this most often when someone writes a PowerShell script or an ADSI (Active Directory Service Interfaces) call and forgets to add the quotes around the password string. The error's pretty clear — "must be enclosed in quotation marks" — but people miss it because they think the password itself is fine.

How to fix it — step by step

1. Check your code or script. Look for where you set unicodePwd. In PowerShell using ADSI, it looks like this:

   $user.Put("unicodePwd", "\"P@ssw0rd\"")
   $user.SetInfo()

   Note the escaped quotes: "\"P@ssw0rd\"". That's double quotes inside double quotes.
2. If you're using System.DirectoryServices in C#:

   user.Invoke("SetPassword", new object[] { "P@ssw0rd" });

   This method handles quotes internally. Don't add them manually here.
3. For LDIF files or ldapmodify:

   dn: cn=jsmith,cn=users,dc=domain,dc=com
   changetype: modify
   replace: unicodePwd
   unicodePwd:: PAB5AG4AdABvAEgAYQByAGQAPgA=
   -

   That base64 string must decode to the quoted password. Example: "P@ssw0rd" (with quotes).
4. Test with a simple PowerShell snippet:

   $user = [ADSI]"LDAP://cn=jsmith,cn=users,dc=domain,dc=com"
   $user.SetPassword("P@ssw0rd")  # This method works correctly

   If SetPassword works but Put fails, it's the quotes.

Alternative fixes if the main one doesn't work

Sometimes the fix isn't about quotes at all. Try these:

• Check if the DC is reachable. Run nltest /dsgetdc:domain.com. If it fails, you're not talking to a domain controller.
• Make sure you're using a secure connection. The unicodePwd attribute requires LDAPS (port 636) or a TLS-encrypted connection. Plain LDAP (port 389) won't work. You'll get a different error (0x52 or 0x51) but sometimes it shows as this one.
• Verify the password meets domain policy. Minimum length, complexity — if it fails, AD won't accept it. Check the domain's password policy with: net accounts /domain.
• Reboot the Domain Controller. Rare, but I've seen it fix stale ADSI cache issues. Don't bother unless other machines also have problems.

How to prevent this error

Stop writing raw LDAP modify operations for passwords. Use the higher-level methods:

• In PowerShell: Set-ADAccountPassword or the ADSI SetPassword() method.
• In C#: DirectoryEntry.Invoke("SetPassword", ...).
• In Python: use python-ldap with passwdModify OID (1.3.6.1.4.1.4203.1.11.1).

If you must set unicodePwd directly, always remember: the value is a quoted string, not just the password. Write a quick test script that logs the actual bytes being sent. That catches quote issues fast.

One last thing: don't waste time on registry fixes or group policy tweaks for this error. The culprit is almost always missing quotes. Check that first, then move to connectivity or policy checks.