What does Windows error code 8471 (ERROR_DS_NAME_ERROR_NOT_UNIQUE) mean?

 
Previous Next
ERROR_DS_NAME_ERROR_NOT_FOUND ERROR_DS_NAME_ERROR_NO_MAPPING

ERROR_DS_NAME_ERROR_NOT_UNIQUE

ERROR_DS_NAME_ERROR_NOT_UNIQUE means that name translation cannot select one definitive result. The input may match more than one directory object, or the selected output format may not have one unique value for the object that was found. This is a disambiguation failure, not a malformed-name failure.

Common source of ambiguity

DS_DISPLAY_NAME is designed for user-friendly text and is not necessarily the object RDN. A value such as Alex Kim is therefore a poor stable key for automation. DS_UNKNOWN_NAME can also make a request slower and less predictable because it asks the server to try possible input forms. Prefer declaring the known input format and keep the chosen identifier with the record that produced it.

How to make the conversion deterministic

  • Capture the offered and desired DS_NAME_FORMAT values with the original input, not just the Windows error code.
  • Use a DN or the directory object GUID as the next diagnostic identifier when a display-oriented name is ambiguous.
  • For account names, include the intended domain rather than relying on a short display value or an unqualified token.
  • When the object was found but the desired representation is not singular, request a representation with a single directory identity instead of letting the caller choose one candidate implicitly.

Do not fix this by taking the first returned match from a separate LDAP search. That can make an access-control or configuration change silently select a different object later. The safer repair is to define an identifier that is unique in the target directory scope.

Microsoft: DS_NAME_ERROR semantics

Microsoft: supported DS_NAME_FORMAT values

RFC 4512: directory entry naming and RDN uniqueness


Looking for a different code? Search another status or error code.