What does Windows error code 8473 (ERROR_DS_NAME_ERROR_DOMAIN_ONLY) mean?

ERROR_DS_NAME_ERROR_DOMAIN_ONLY

ERROR_DS_NAME_ERROR_DOMAIN_ONLY is a partial-resolution result. Active Directory could not translate the entire object name from the current binding, but it did determine the DNS domain in which the object resides. In the corresponding DS_NAME_ERROR_DOMAIN_ONLY result, DS_NAME_RESULT_ITEM.pDomain contains usable domain data.

Use the partial result

This status is a routing signal, not a reason to discard the request. Microsoft documents the expected flow: bind to a domain controller for the reported domain, or use a suitable global catalog, then repeat DsCrackNames with the new binding handle. The original offered and desired name formats must stay the same while testing that route.

Checks that prevent false fixes

• Log pDomain, the original bind target, and whether the initial server was a global catalog.
• Verify DNS discovery and DC reachability for the reported domain before changing the name string.
• Use the same security context for the retry. A different identity can hide an access-visibility problem behind a routing change.
• Distinguish this from TRUST_REFERRAL, which identifies an external trusted forest, and from NOT_FOUND, which does not provide a reliable domain route.

For code that processes arrays of names, treat this as a per-item result. Other names in the same DsCrackNames call can be converted successfully, so an application should not throw away the complete result structure after the first nonzero status.

Microsoft: DsCrackNames retry behavior and binding scope

Microsoft: DS_NAME_RESULT_ITEM and pDomain

RFC 4512: LDAP directory information model

Looking for a different code? Search another status or error code.