What does Windows error code 8318 (ERROR_DS_ATT_ALREADY_EXISTS) mean?

ERROR_DS_ATT_ALREADY_EXISTS

Attribute presence is separate from attribute values

ERROR_DS_ATT_ALREADY_EXISTS is raised while Active Directory is applying a directory modification and the operation tries to add an attribute that the entry already has. It is not a statement that the object itself already exists, and it is not necessarily the same condition as adding a duplicate value to a multi-valued attribute.

In LDAP, an entry is a set of attributes, each with zero or more values. A provisioning workflow can reach this status when an add change is replayed after a timeout, when two reconciliation jobs act on the same entry, or when a client emits an add change where a replace or an idempotent comparison was required.

What to examine

• Read the current entry immediately before the failing write and compare the requested attribute names with the existing attribute set.
• Preserve the LDAP modify operation in logs: the distinction between add, delete, and replace changes the interpretation of the failure.
• For retryable provisioning, use a read-compare-write pattern or make the desired final state explicit instead of replaying an unconditional add.
• Do not treat this as a schema-extension failure unless the attribute is also absent from attributeSchema; this code concerns the target object state.

Related distinction

ERROR_DS_ATT_VAL_ALREADY_EXISTS concerns a value that duplicates an existing value. This status concerns the attribute slot itself. The two should be separated in diagnostics because they require different changes to the client request.

References

• RFC 4511: LDAP Modify and Add operations
• RFC 4512: LDAP directory information models and attribute values
• Microsoft: Active Directory schema implementation

Looking for a different code? Search another status or error code.