Windows error 8358 (ERROR_DS_CANT_ADD_SYSTEM

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A system-owned Active Directory attribute cannot be added directly.

Previous	Next
ERROR_DS_NCNAME_MUST_BE_NC	ERROR_DS_CLASS_MUST_BE_CONCRETE

ERROR_DS_CANT_ADD_SYSTEM_ONLY

ERROR_DS_CANT_ADD_SYSTEM_ONLY (8358) is an Active Directory Domain Services error. The request tried to add a system-only attribute. These attributes are maintained by Active Directory or another supported subsystem and are intentionally not writable through ordinary LDAP or PowerShell updates.

What to check

Inspect the attributeSchema definition to confirm that the attribute is system-owned or otherwise restricted.
Identify the supported management action that causes Active Directory to maintain the value.
Do not bypass the restriction by editing directory database files or using unsupported schema changes.

Useful command

Get-ADObject -SearchBase (Get-ADRootDSE).schemaNamingContext -LDAPFilter "(lDAPDisplayName=<attributeName>)" -Properties systemOnly

Microsoft: Characteristics of AD attributes · Microsoft: AD DS schema updates · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.