What does Windows error code 8216 (ERROR_DS_CROSS_DOM_MOVE_ERROR) mean?

ERROR_DS_CROSS_DOM_MOVE_ERROR

The requested cross-domain move operation could not be performed.

ERROR_DS_CROSS_DOM_MOVE_ERROR is Win32 error 8216 (0x00002018) in Active Directory Domain Services (AD DS). Interpret ERROR_DS_CROSS_DOM_MOVE_ERROR at the call that produced it and use the system message above as the immediate condition rather than as a complete root cause.

Windows assigns decimal 8216 and hexadecimal 0x00002018 to ERROR_DS_CROSS_DOM_MOVE_ERROR. For ERROR_DS_CROSS_DOM_MOVE_ERROR, the decisive subject is moving an Active Directory object across domain boundaries; the value alone does not reveal which object, server, file, session, or transition failed.

Where this result appears

• For ERROR_DS_CROSS_DOM_MOVE_ERROR, processing moving an Active Directory object across domain boundaries.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, executing an LDAP, RPC, deployment, replication, or directory-management operation.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, working against a specific domain controller whose replica and schema state affect the result.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, translating extended directory diagnostics into a Win32 error for an application or administration tool.

State boundary to prove

ERROR_DS_CROSS_DOM_MOVE_ERROR applies to moving an Active Directory object across domain boundaries and does not by itself prove that the entire server, directory, disk, session, or application is unavailable. The state boundary to prove for ERROR_DS_CROSS_DOM_MOVE_ERROR is whether source and destination domains, object class, credentials, RID allocation, and dependencies satisfy the cross-domain move contract. Use source and destination distinguished names, object class and child count, and selected domain controllers as independent evidence. When evidence for ERROR_DS_CROSS_DOM_MOVE_ERROR disagrees, preserve timestamps and investigate the transition instead of selecting the most convenient value.

Likely causes

• For ERROR_DS_CROSS_DOM_MOVE_ERROR, the object class or child objects cannot be moved across domains.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, source and destination controllers cannot coordinate.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, credentials lack rights in one domain.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, the target name or security principal state conflicts.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, required infrastructure or RID services are unavailable.

Diagnostic sequence

1. For ERROR_DS_CROSS_DOM_MOVE_ERROR, capture error 8216 immediately at the API boundary and record the operation that was attempted.
2. For ERROR_DS_CROSS_DOM_MOVE_ERROR, identify the exact owner of moving an Active Directory object across domain boundaries, including object generation, server, path, session, replica, or client context.
3. For ERROR_DS_CROSS_DOM_MOVE_ERROR, collect source and destination distinguished names before restarting a service or changing configuration.
4. For ERROR_DS_CROSS_DOM_MOVE_ERROR, compare object class and child count with the documented or observed precondition.
5. For ERROR_DS_CROSS_DOM_MOVE_ERROR, correlate selected domain controllers with the Directory Service event log, LDAP extended diagnostics, replication metadata, dcdiag and repadmin output, and the calling application’s request trace.
6. For ERROR_DS_CROSS_DOM_MOVE_ERROR, determine whether side effects occurred and verify recovery after changing one responsible condition.

Evidence to collect

• For ERROR_DS_CROSS_DOM_MOVE_ERROR, source and destination distinguished names.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, object class and child count.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, selected domain controllers.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, rights on both containers.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, Netlogon, Directory Service, and replication events.

Correlate ERROR_DS_CROSS_DOM_MOVE_ERROR with the Directory Service event log, LDAP extended diagnostics, replication metadata, dcdiag and repadmin output, and the calling application’s request trace. Keep the first detailed status even when a later wrapper translates it to error 8216; the first status often distinguishes transport, authorization, storage, schema, state, and application-integrity causes that share the same final Win32 result.

Handling, retry, and recovery

For ERROR_DS_CROSS_DOM_MOVE_ERROR, the recovery objective is to validate the move prerequisites on both domains, remove naming or dependency conflicts, and repeat through the supported directory API instead of recreating security principals manually.

Retry ERROR_DS_CROSS_DOM_MOVE_ERROR only after the recorded condition changes and completion state is known. For ERROR_DS_CROSS_DOM_MOVE_ERROR, idempotent queries may be repeated after recovery, but mutations require a state check first; backoff cannot repair malformed input, corruption, missing structure, or policy rejection.

Telemetry and support fields

• For ERROR_DS_CROSS_DOM_MOVE_ERROR, record ds_cross_dom_move_error_api for the producing function or management operation.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, record ds_cross_dom_move_error_target for the file, log, session, replica, object, or server identity.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, record ds_cross_dom_move_error_state_before and ds_cross_dom_move_error_requested_transition.
• For ERROR_DS_CROSS_DOM_MOVE_ERROR, record ds_cross_dom_move_error_first_status for the earliest lower-level diagnostic.

For support escalation involving ERROR_DS_CROSS_DOM_MOVE_ERROR, retain decimal 8216, hexadecimal 0x00002018, the API, UTC time, target identity, and first subsystem-specific status. For ERROR_DS_CROSS_DOM_MOVE_ERROR, include the smallest reproducible request and evidence that distinguishes this condition from nearby codes. In the context of ERROR_DS_CROSS_DOM_MOVE_ERROR, many ds codes are internal or management-facing and are not tied to one public function. the producing ldap, rpc, deployment, or management api must therefore be recorded with the code.

Difference from nearby results

For ERROR_DS_CROSS_DOM_MOVE_ERROR, ERROR_DS_MODIFYDN_WRONG_GRANDPARENT concerns an in-domain hierarchy restriction; this code concerns crossing a domain boundary

Practical validation scenario

An automation tries to move a computer object with unsupported dependent state into another domain. A supported migration workflow preserves identity and completes the cross-domain transition. The negative test should preserve the responsible condition and reproduce ERROR_DS_CROSS_DOM_MOVE_ERROR; the recovery test should change only the identified cause, repeat the same operation, and verify both success and the absence of an unintended partial side effect.

Developer and administrator guidance

Administrators handling ERROR_DS_CROSS_DOM_MOVE_ERROR should preserve Directory Service events, replication metadata, and the contacted domain controller before changing objects or forcing role transitions. For ERROR_DS_CROSS_DOM_MOVE_ERROR, developers should retain LDAP extended diagnostics and object identities across wrappers so the Win32 code does not erase the actionable directory result. Code that exposes ERROR_DS_CROSS_DOM_MOVE_ERROR through RPC, JSON, REST, PowerShell, or another protocol should preserve the Win32 domain, decimal 8216, hexadecimal 0x00002018, and original component diagnostic.

References

• Microsoft: Win32 system error range containing this code — official context relevant to ERROR_DS_CROSS_DOM_MOVE_ERROR.
• Microsoft: AD DS troubleshooting — official context relevant to ERROR_DS_CROSS_DOM_MOVE_ERROR.
• Microsoft: repadmin — official context relevant to ERROR_DS_CROSS_DOM_MOVE_ERROR.
• Microsoft: dcdiag — official context relevant to ERROR_DS_CROSS_DOM_MOVE_ERROR.
• Microsoft: AD and LDS diagnostic event logging — official context relevant to ERROR_DS_CROSS_DOM_MOVE_ERROR.

Looking for a different code? Search another status or error code.