diff --git a/docs/test-environment/New-PortalTestEnvironment.ps1 b/docs/test-environment/New-PortalTestEnvironment.ps1
index 9e75628..e085690 100644
--- a/docs/test-environment/New-PortalTestEnvironment.ps1
+++ b/docs/test-environment/New-PortalTestEnvironment.ps1
@@ -72,6 +72,7 @@ $domain = Get-ADDomain
 $netbios = $domain.NetBIOSName
 $testOuDn = "OU=$TestOuName,$ParentDn"
 $svcOuDn = "OU=$ServiceOuName,$ParentDn"
+$svcDn = "CN=$ServiceAccountName,$svcOuDn"
 $real = -not $WhatIfPreference
 $secrets = [ordered]@{}
 $groups = @{}
@@ -89,7 +90,6 @@ foreach ($ou in @(@($TestOuName, $testOuDn), @($ServiceOuName, $svcOuDn))) {
 }
 
 # --- service account (outside the test OU on purpose) ------------------------
-$svcDn = "CN=$ServiceAccountName,$svcOuDn"
 if (Test-Dn $svcDn) {
     Write-Host "Service account exists: $svcDn (password unchanged)"
 }
diff --git a/docs/test-environment/Test-PortalLdaps.ps1 b/docs/test-environment/Test-PortalLdaps.ps1
index fe79a76..4b420f4 100644
--- a/docs/test-environment/Test-PortalLdaps.ps1
+++ b/docs/test-environment/Test-PortalLdaps.ps1
@@ -134,7 +134,13 @@ if ($TestPasswordChange) {
     $add.Name = 'unicodePwd'; $add.Operation = 'Add'; [void]$add.Add($enc.GetBytes('"' + $newPw + '"'))
     $ok = $true; $detail = ''
     try { [void]$conn.SendRequest((New-Object System.DirectoryServices.Protocols.ModifyRequest($userDn, @($del, $add)))) }
-    catch { $ok = $false; $detail = $_.Exception.Message }
+    catch {
+        $ok = $false; $detail = $_.Exception.Message
+        $inner = $_.Exception.InnerException
+        if ($inner -is [System.DirectoryServices.Protocols.DirectoryOperationException]) {
+            $detail += " [LDAP result: $($inner.Response.ResultCode); server: $($inner.Response.ErrorMessage)]"
+        }
+    }
     Report 'change a password with the Change Password right' $ok $detail
 }
 else { Write-Host 'SKIP  password change (use -TestPasswordChange; it changes the test user password)' -ForegroundColor Yellow }