diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index dad24e1f3f..8fcf6e7aa4 100644
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -1714,7 +1714,11 @@ static int parseDomainScope (
 		return LDAP_PROTOCOL_ERROR;
 	}
 
-	if ( !BER_BVISNULL( &ctrl->ldctl_value )) {
+	/* this should be checking BVISNULL, but M$ clients are broken
+	 * and include the value even though the M$ spec says it must be
+	 * omitted. ITS#9100.
+	 */
+	if ( !BER_BVISEMPTY( &ctrl->ldctl_value )) {
 		rs->sr_text = "domainScope control value not absent";
 		return LDAP_PROTOCOL_ERROR;
 	}