| Previous | Next |
| ERROR_DS_CANT_REM_MISSING_ATT_VAL | ERROR_DS_NO_CHAINING |
ERROR_DS_ROOT_CANT_BE_SUBREF
A namespace root cannot be used as a subref
Active Directory partitions its namespace into naming contexts and maintains metadata describing boundaries between directory partitions. A subordinate reference is directory namespace metadata, not an ordinary alias entry. Treating the root object as such a reference conflicts with the role of the root in the directory information tree.
Start by identifying which root the operation means: LDAP rootDSE, a naming-context head, or an application-selected search base. rootDSE itself is not part of a naming context, while domain, configuration, schema, and application partitions have distinct naming-context roots. Fixing the DN text without resolving that semantic mismatch will not correct the operation.
What to inspect
- Read rootDSE naming-context attributes on the server that returned the error.
- Verify the intended partition boundary and the parent/child relationship being created.
- Do not model a subref as a normal LDAP alias or arbitrary leaf object.
References
- Microsoft: RootDSE naming-context metadata
- IETF RFC 4512: LDAP directory model, aliases, DNs, and schema
- MS-ADTS: constraints on Active Directory Add operations
Looking for a different code? Search another status or error code.