What does Windows error code 8424 (ERROR_DS_CANT_REPLACE_HIDDEN_REC) mean?

ERROR_DS_CANT_REPLACE_HIDDEN_REC

ERROR_DS_CANT_REPLACE_HIDDEN_REC (8424) is an Active Directory Domain Services error. The operation attempted to replace a hidden or protected internal directory record. Such records participate in directory implementation and topology and are not ordinary application objects.

Identify the API or tool that attempted to replace the internal record and stop direct manipulation of that object. Repair the higher-level directory feature or topology through supported AD DS operations that own the hidden metadata.

What to check

• Identify the administrative tool or application that issued the request.
• Check the Directory Service log for the object class and preceding error that led to the replacement attempt.
• Do not expose, recreate, or overwrite internal records through low-level directory edits.

Useful command

dcdiag /v /c

Microsoft: DCDiag · Microsoft: Directory Service system error codes · Microsoft: Impact of schema changes