| Previous | Next |
| ERROR_DS_ILLEGAL_SUPERIOR | ERROR_DS_NAME_TOO_MANY_PARTS |
ERROR_DS_ATTRIBUTE_OWNED_BY_SAM
SAM owns the attribute and direct LDAP modification is blocked
Some attributes on user and group objects are system-maintained as part of Security Accounts Manager behavior. MS-ADTS explicitly lists attributes that are disallowed in LDAP Add or Modify for SAM-specific classes, including examples such as objectSid, rid, memberOf, logon counters, and computed account-control data. Possessing Write Property does not make these fields client-writable.
Find the exact attribute in the failing modification and determine which subsystem is supposed to maintain it. For linked values such as memberOf, the writable direction can be the corresponding forward link rather than the backlink. For account state and credentials, use the documented account-management operation instead of attempting to stamp internal state directly.
What to inspect
- Log the full modification list and isolate the SAM-owned attribute.
- Check whether the value is computed, system-maintained, or a backlink.
- Use the supported SAM/AD operation that causes the desired state transition.
References
- MS-ADTS: constraints on Active Directory Add operations
- MS-ADTS: constraints on Active Directory Modify operations
- MS-ADTS: linked attribute and linkID rules
Looking for a different code? Search another status or error code.