Windows error 8398 (ERROR_DS_CANT_DELETE): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The requested Active Directory delete operation could not be completed.

Previous	Next
ERROR_DS_TREE_DELETE_NOT_FINISHED	ERROR_DS_ATT_SCHEMA_REQ_ID

ERROR_DS_CANT_DELETE

ERROR_DS_CANT_DELETE (8398) is an Active Directory Domain Services error. This is a general directory delete failure. The useful cause is usually an earlier condition: insufficient rights, remaining child objects, protected/critical object flags, a replica mismatch, or a stale target DN.

What to check

Inspect the preceding Directory Service or application log entry for the more specific error.
Verify the object DN, child-object state, protection settings, and access control list.
Perform the operation against a writable DC that holds the intended naming context.

Useful command

dcdiag /test:Advertising /test:Services /v

Microsoft: DCDiag · Microsoft: Directory Service system error codes · Microsoft: Diagnose AD replication failures

Looking for a different code? Search another status or error code.