| Previous | Next |
| ERROR_DS_GENERIC_ERROR | ERROR_DS_CLASS_NOT_DSA |
ERROR_DS_DSA_MUST_BE_INT_MASTER
This operation targets an internal master DSA role
This status is narrower than a general requirement for a writable domain controller. Active Directory has internal master DSA state for operations whose consistency depends on one designated directory agent. A different DC may host a full replica and replicate normally, yet it still cannot originate the requested master-only change.
The practical distinction matters when administrative code binds to whichever DC is closest. Read and ordinary update workloads often tolerate that strategy; master-specific directory operations do not. The client needs to discover the owning server from directory metadata and perform the operation in the role context expected by AD.
What to inspect
- Capture the API or LDAP control that returned the code and the precise DC that processed it.
- Inspect role-owner and
nTDSDSAmetadata for the affected NC instead of treating the error as an ACL failure. - Before moving a master role, confirm the existing owner is unavailable or unsuitable and verify replication state on the proposed target.
References
Looking for a different code? Search another status or error code.