What does HRESULT 0x80045392 (FSRM_E_ADR_NOT_DOMAIN_JOINED) mean?

 
Previous Next
FSRM_E_ADR_PATH_IS_LOCAL FSRM_E_CANNOT_REMOVE_READONLY

FSRM_E_ADR_NOT_DOMAIN_JOINED

FSRM_E_ADR_NOT_DOMAIN_JOINED is the failure HRESULT 0x80045392 (signed decimal -2147200110, unsigned decimal 2147767186). Its severity bit is 1, facility is 4 (FACILITY_ITF), and the facility-specific code field is 0x5392.

Access-Denied Assistance requires a domain-joined file server

This HRESULT is returned when Access-Denied Assistance is requested on a server that is not joined to a domain. ADR is designed to provide customized denial information and an access-request workflow for users of shared files. A standalone or workgroup server does not satisfy that identity and policy prerequisite.

AllStat records the official condition as: “Access-denied assistance requires that the server be joined to a domain.” The wording should be interpreted at this FSRM stage, not as a generic file-system or COM failure.

Where the failure boundary lies

The code concerns the file server that owns the SMB resource, not necessarily the administrator workstation, DFS namespace server, or client displaying the message. Domain membership alone is also not the complete ADR configuration: the server must have a healthy domain relationship, the feature and policy must be configured, and the request must traverse a supported remote share path.

Likely causes to separate

  • The target file server is configured as a workgroup computer.
  • A cloned, restored, or renamed server lost its domain membership or secure channel.
  • Automation checked the management host while the active DFS target is a different non-domain server.
  • The computer account was removed or trust repair is pending even though old domain settings remain visible.

Evidence worth preserving

  • Identify the exact SMB server handling the denied path, including the selected DFS referral target.
  • Record domain membership, computer-account identity, secure-channel test result, and DNS domain configuration.
  • Capture ADR policy and FSRM settings from the target server rather than from a central management workstation.
  • Preserve the client access path and confirm the denial occurred remotely, not through a local drive path.

Diagnostic sequence

  • Verify the active target with the UNC path and SMB connection information before checking domain state.
  • Confirm that the server is joined to the intended Active Directory domain and that its computer account is enabled.
  • Test domain controller discovery, DNS records, time synchronization, and the machine secure channel.
  • After domain health is restored, review ADR deployment settings, customized messages, owner notification, and client support separately.

Retry and recovery

Join the actual file server to the domain or repair its broken trust using normal domain-administration procedures, then restart or refresh the services required by that change and retest ADR from a remote client. Do not join an appliance or third-party storage system merely to suppress the HRESULT; use a conventional support workflow when the platform cannot support ADR.

What this HRESULT does not establish

The result does not say that NTFS permissions are wrong and does not grant access to the user. It only blocks the assistance layer that explains or routes the denial. Successful domain join still requires correct ADR and email/request configuration.

Difference from nearby FSRM results

FSRM_E_ADR_PATH_IS_LOCAL rejects a local path even on a domain member. FSRM_E_ADR_SRV_NOT_SUPPORTED reports that the target server lacks the required ADR capability.

Practical scenario

A DFS namespace directs one branch office to a replacement file server that was never joined to the domain. Users receive ordinary access-denied responses, and ADR lookup returns this code. The operator identifies the active DFS target, joins and configures that server, then repeats the test through the share.

Guidance for software and telemetry

ADR clients should log the resolved server name and not infer domain status from the original namespace string. Administration tools should display the domain prerequisite before offering message or request configuration.

Official Microsoft references

Looking for a different code? Search another status or error code.