| Previous | Next |
| ERROR_DS_CANT_RETRIEVE_CHILD | ERROR_DS_CANT_REPLACE_HIDDEN_REC |
ERROR_DS_SECURITY_ILLEGAL_MODIFY
The modification was not permitted for security reasons.
ERROR_DS_SECURITY_ILLEGAL_MODIFY is Win32 error 8423 (0x000020E7) in Active Directory Domain Services (AD DS).
What to verify
Verify whether the requested attribute and operation are permitted for the object class, security principal, and protected state. Check object DN and class, attribute and old/new values, and caller and granted rights.
Likely causes
- the attribute is system-managed or protected.
- the caller attempts to weaken a protected security setting.
- the object is protected by directory rules beyond its DACL.
- the operation requires a specialized management API.
Troubleshooting steps
- Collect object DN and class.
- Record attribute and old/new values.
Handling, retry, and recovery
Use the documented management operation or change an allowed attribute; do not bypass the rule by manipulating replication or database state.
Related errors
ERROR_ACCESS_DENIED can arise from a normal ACL; this code indicates that the modification itself is illegal under directory security rules
Example
An application tries to write a system-maintained security attribute directly. Switching to the supported account-management API performs the intended change within directory policy.
References
Looking for a different code? Search another status or error code.