diff --git a/changelog.html b/changelog.html
index 9f770ca9c8..7df33fa441 100644
--- a/changelog.html
+++ b/changelog.html
@@ -65,6 +65,9 @@ Upcoming changes</a>
     (<a href="https://issues.jenkins-ci.org/browse/JENKINS-12529">issue 12529</a>)  
   <li class=ref>
     Matrix job now allows delete whole matrix, including sub-jobs.
+  <li class=bug>
+    Fixed a bug in LDAP default root DN inference.
+    (<a href="https://issues.jenkins-ci.org/browse/JENKINS-8152">issue 8152</a>)
 </ul>
 </div><!--=TRUNK-END=-->
 
diff --git a/core/src/main/java/hudson/security/LDAPSecurityRealm.java b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
index fbe5188b79..37f94ac1b1 100644
--- a/core/src/main/java/hudson/security/LDAPSecurityRealm.java
+++ b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
@@ -325,8 +325,8 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
             DirContext ctx = new InitialDirContext(props);
             Attributes atts = ctx.getAttributes("");
             Attribute a = atts.get("defaultNamingContext");
-            if(a!=null) // this entry is available on Active Directory. See http://msdn2.microsoft.com/en-us/library/ms684291(VS.85).aspx
-                return a.toString();
+            if(a!=null && a.get()!=null) // this entry is available on Active Directory. See http://msdn2.microsoft.com/en-us/library/ms684291(VS.85).aspx
+                return a.get().toString();
             
             a = atts.get("namingcontexts");
             if(a==null) {