| Previous | Next |
| ERROR_DS_CLASS_NOT_DSA | ERROR_DS_ILLEGAL_SUPERIOR |
ERROR_DS_INSUFF_ACCESS_RIGHTS
The directory access check rejected the requester
Active Directory authorization is evaluated against the target object security descriptor and the exact requested operation. A user can read an object yet lack Write Property on one attribute, Create Child on a container, Delete Child, a control access right, or another operation-specific permission. Membership in a broad administrative group should not replace analysis of the actual access check.
Capture the authenticated identity, target DN, requested attributes, LDAP control set, and whether the update is originating or replicated. MS-ADTS defines additional checks for partition secrets, security descriptor changes, password operations, delegation attributes, and undelete. Granting Full Control at a high container can mask the root cause and expand permissions unnecessarily.
What to inspect
- Identify the precise right and object where the access check occurs.
- Review explicit and inherited ACEs in nTSecurityDescriptor.
- Check special control-access or privilege requirements before changing ACL inheritance.
References
- MS-ADTS: access checks for directory modifications
- MS-ADTS: security descriptor requirements
- MS-ADTS: constraints on Active Directory Modify operations
Looking for a different code? Search another status or error code.