| Previous | Next |
| ERROR_DS_DSA_MUST_BE_INT_MASTER | ERROR_DS_INSUFF_ACCESS_RIGHTS |
ERROR_DS_CLASS_NOT_DSA
The operation expected a directory-service-agent object
ERROR_DS_CLASS_NOT_DSA indicates that Active Directory expected an object representing a Directory System Agent (DSA), but the supplied object has another class. A DSA is associated with a domain controller's directory-service role and replication topology; this is not an ordinary user, computer, group, or application object-class problem.
The code is most relevant to topology, replication, or directory-service administration. It can surface when an administrative tool follows a stale distinguished name, when a server object is confused with its directory-service-agent child, or when an unsupported script tries to manipulate AD internals using generic LDAP paths.
Safe diagnostic direction
- Identify the exact distinguished name used by the failing operation and retrieve its
objectClassvalues. - Verify the relationship between the server object and the directory-service-agent object instead of substituting one for the other.
- Check domain-controller and replication health before changing topology records; a missing or inconsistent DSA object can have broader consequences than a single application failure.
- Avoid manually creating or reclassifying DSA objects to silence this code. Use supported domain-controller recovery and topology procedures.
Why normal schema extension guidance is insufficient
Custom classes and attributes belong to application schema design. DSA objects belong to the directory service's own replication infrastructure, so the repair path is operational health and supported administration rather than adding a new classSchema record.
References
- Microsoft: AD schema objects and the schema naming context
- Microsoft: class identity and class hierarchy in AD DS
- RFC 4512: directory object classes and schema constraints
Looking for a different code? Search another status or error code.