What does Windows error code 8306 (ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA) mean?

ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA

The class does not provide a usable naming attribute

ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA occurs when AD DS is asked to create an object of a class whose schema does not define the information needed for its relative distinguished name (RDN). The RDN is the leftmost component of an LDAP distinguished name and identifies the entry below its parent.

For a custom class, the relevant classSchema data includes rDnAttId, which identifies the naming attribute. The attribute must be valid for the class and use a suitable directory-string syntax. A client cannot compensate for a missing schema definition simply by placing an arbitrary attribute in the requested DN.

Concrete checks

• Read the target classSchema object and inspect rDnAttId, mustContain, mayContain, and inherited class definitions.
• Confirm that the value used in the new object's RDN is allowed by the class and is represented by the naming attribute expected by the schema.
• Check the parent class and possSuperiors rules as well; a valid RDN alone does not make a placement legal.
• Test schema-extension LDIF in an isolated forest before production deployment, because schema additions affect the entire forest and cannot simply be removed later.

Do not confuse it with a duplicate name

A duplicate RDN under the same parent leads to a name-collision condition. This code is earlier: the server cannot determine how an instance of this class should be named at all.

References

• Microsoft: rDnAttId, naming attributes, and possible parents
• RFC 4511: LDAP Add and relative distinguished names
• RFC 4512: names, attribute types, and object classes