What does Windows error code 8470 (ERROR_DS_NAME_ERROR_NOT_FOUND) mean?

ERROR_DS_NAME_ERROR_NOT_FOUND

ERROR_DS_NAME_ERROR_NOT_FOUND is a name-translation result, not simply a statement that an account does not exist. Active Directory uses this condition when the name cannot be found or when the caller lacks permission to access it. A well-formed DN, UPN, or NT4 account name can therefore produce the same status for two operationally different reasons.

Scope can change the answer

DsCrackNames resolves names in the scope of the directory service binding. A global catalog bind has forest-wide scope; a normal domain controller bind does not. If the name unambiguously identifies a domain in the same forest but the current bind cannot resolve the object, the more specific DOMAIN_ONLY result can carry that domain in pDomain. A plain NOT_FOUND does not establish that the object is absent from every directory partition.

What to verify

• Confirm the declared input format. A DN such as CN=Alice,OU=Users,DC=example,DC=com is not interchangeable with alice@example.com or EXAMPLE\alice.
• Check the bind target and credentials used by the application, especially when the object is expected to be visible only in another domain or forest.
• For a DN, validate escaping and RDN structure under RFC 4514 before treating the result as a directory lookup problem.
• Compare the application identity with an administrative test identity only to distinguish access visibility from object absence; do not infer which case occurred from this status alone.

NOT_FOUND differs from NOT_UNIQUE, where several candidates exist, and from NO_MAPPING, where the object was located but lacks data needed for the requested output form.

Microsoft: DsCrackNames scope and per-name results

Microsoft: DS_NAME_RESULT_ITEM

RFC 4514: LDAP distinguished-name syntax

Looking for a different code? Search another status or error code.