| Previous | Next |
| ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD | ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS |
ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION
Active Directory blocks this class of object from crossing domains
Cross-domain moves are permitted only for directory objects whose class and security semantics can be reconstructed safely in the target domain. MS-ADTS explicitly excludes system-owned and infrastructure classes, and special security principals can also be restricted by RID, trust, or role behavior. The error is therefore a policy and object-model constraint, not merely a permissions failure.
Read the object’s most-specific structural class, systemOnly state, SID/RID role, and any protected or trust-account characteristics. Confirm that the intended operation is an in-forest move rather than an inter-forest migration, which uses different tooling and often creates a new object plus SID history. Do not force the operation through low-level attribute copying; system-maintained attributes and linked references cannot be safely reproduced that way.
What to inspect
- Inspect objectClass and the most-specific structural class.
- Determine whether the principal is a trust, built-in, or restricted-RID object.
- Use an export/recreate or supported migration workflow when moves are prohibited.
References
- MS-ADTS: classes prohibited from cross-domain move
- MS-ADTS: cross-domain move protocol
- Microsoft: supported Move-ADObject scenarios
Looking for a different code? Search another status or error code.