| Previous | Next |
| ERROR_DS_ATT_IS_NOT_ON_OBJ | ERROR_DS_OBJ_TOO_LARGE |
ERROR_DS_ILLEGAL_MOD_OPERATION
The modify verb is valid, but the update is not permitted
An LDAP Modify request can be well formed and still violate Active Directory rules for the target object or attribute. MS-ADTS defines additional originating-update constraints beyond generic LDAP syntax. Examples include changes to protected system-maintained attributes, modifications of deleted objects outside an undelete flow, and special restrictions on SAM-specific or schema objects.
The useful diagnostic input is the complete modification list: attribute name, add/delete/replace operation, values, controls, target DN, and the server that processed the request. Retrying the same request with broader rights does not fix a semantic prohibition. Some cases are authorization failures, but this code often means the directory model itself rejects the requested transition.
What to inspect
- Separate LDAP encoding success from directory constraint validation.
- Identify the first attribute and modification verb that violates the server rules.
- Check whether a documented control or specialized API is required for the intended operation.
References
- MS-ADTS: constraints on Active Directory Modify operations
- IETF RFC 4511: LDAP protocol operations and result semantics
- MS-ADTS: access checks for directory modifications
Looking for a different code? Search another status or error code.