What does Windows error code 586 (ERROR_BACKUP_CONTROLLER) mean?

ERROR_BACKUP_CONTROLLER

What this result means

ERROR_BACKUP_CONTROLLER is a Windows system result. The target server is acting as a backup or non-authoritative controller for an operation that must run against the primary authority. In modern Active Directory environments, the equivalent requirement is often tied to a specific FSMO role or writable domain controller.

Likely causes

• the application contacted a read-only or non-authoritative controller
• role ownership changed but cached discovery data was not refreshed
• the domain topology is legacy or mixed and the operation assumes a primary controller
• DNS or site selection directed the request to the wrong server

Where this code is usually encountered

• An operation requiring an authoritative writable controller is sent to a backup, read-only, or non-role-owning server.
• Cached controller discovery survives a role transfer or site change.
• Legacy software assumes the old primary/backup domain-controller model.

Useful evidence

• the exact server contacted and how it was selected
• writable/read-only status, site, and relevant FSMO role owner
• DNS SRV responses and Netlogon discovery output
• replication status and recent role-transfer history

Troubleshooting steps

1. Determine which operation requires authority; password, schema, naming, and time-related tasks can have different role requirements.
2. Rediscover a controller using the supported locator APIs and required flags.
3. Confirm that DNS and site topology return the intended writable server from the affected client network.
4. Remove cached or configured controller names and repeat after replication converges.

Guidance for developers

Use DsGetDcName or higher-level directory APIs with flags matching the operation. Do not infer authority from a server name, and retry only after rediscovery because repeating against the same controller cannot succeed.

Guidance for administrators

Verify role ownership and replication before transferring or seizing anything. A role seizure is not a routine fix for client software that selected the wrong server.

How to interpret it correctly

This code does not necessarily mean the contacted server is unhealthy. It may be functioning correctly while refusing an operation outside its authority.

Example failure pattern

For example, a password or directory-management utility may cache a controller discovered before a role transfer. The server remains reachable and answers ordinary LDAP queries, yet refuses the one operation requiring a writable or authoritative role. Logging the discovery flags and role owner makes this distinction visible.

Retry and recovery policy

Retry only after controller rediscovery or topology convergence. A generic network retry against the same host is ineffective because the refusal is based on authority, not transient packet loss.

References

• Microsoft: System error codes 500–999
• Microsoft: System error codes