What does Windows error code 8391 (ERROR_DS_SUB_CLS_TEST_FAIL) mean?

ERROR_DS_SUB_CLS_TEST_FAIL

subClassOf does not form a valid inheritance chain

The subClassOf field is more than a textual parent pointer. Active Directory validates that the superclass exists, is active, and that the resulting inheritance chain follows class-category and hierarchy rules. MS-ADTS also applies special consistency checks such as preventing invalid use of dynamicObject in subclass relationships.

Trace the complete superclass chain rather than examining only the immediate class named in the failing LDIF. A cycle, category mismatch, missing class, or invalid inherited relationship can surface when the new class is validated. The repair belongs in the class design; schema cache refresh and directory ACL changes do not alter inheritance semantics.

What to inspect

• Walk the full subClassOf chain for the proposed class.
• Read objectClassCategory for every class involved in the hierarchy.
• Compare the design with MS-ADTS inheritance rules before retrying the schema update.

References

• MS-ADTS: schema consistency checks
• Microsoft: classSchema class
• IETF RFC 4512: LDAP directory models and schema

Looking for a different code? Search another status or error code.