What does Windows error code 8345 (ERROR_DS_ILLEGAL_SUPERIOR) mean?

ERROR_DS_ILLEGAL_SUPERIOR

The object class cannot be placed under this parent

Active Directory schema class definitions include possible-superior relationships. A structural class can be created only beneath container classes allowed by possSuperiors and systemPossSuperiors, including inherited rules. This error means the requested parent exists, but its class is not a legal superior for the object being added.

This is not repaired by changing ACLs or by creating the same DN again. Compare the child structural class with the parent object class and the schema consistency rules. If an application is writing to a custom container, the schema extension must model that placement correctly. Otherwise, select a container that is already an allowed superior for the intended class.

What to inspect

• Read the parent objectClass and the child class possSuperiors relationships.
• Include inherited class rules when evaluating legal placement.
• Separate a schema placement failure from insufficient create-child permissions.

References

• MS-ADTS: schema consistency checks
• Microsoft: classSchema class
• IETF RFC 4512: LDAP directory models and schema

Looking for a different code? Search another status or error code.