| Previous | Next |
| ERROR_DS_BAD_NAME_SYNTAX | ERROR_DS_CANT_DEREF_ALIAS |
ERROR_DS_ALIAS_POINTS_TO_ALIAS
Active Directory rejects an alias-to-alias target
LDAP directory models can describe recursive alias dereferencing, and RFC 4511 requires servers to detect loops when dereferencing aliases during search. This Active Directory status is more direct: the alias being processed refers to another alias instead of the final target object. The directory does not accept that alias chain for the operation.
Inspect aliasedObjectName on both entries without automatic dereferencing. Replace the first alias target with the final non-alias object if that is the intended design. Merely proving there is no cycle is insufficient; a two-level chain can still violate the Active Directory restriction represented by this code.
What to inspect
- Read objectClass and aliasedObjectName for every entry in the chain.
- Resolve the final intended object explicitly.
- Avoid application logic that creates aliases from previously resolved alias DNs.
References
- IETF RFC 4511: LDAP protocol operations and result semantics
- IETF RFC 4512: LDAP directory model, aliases, DNs, and schema
- MS-ADTS: constraints on Active Directory Modify operations
Looking for a different code? Search another status or error code.