| Previous | Next |
| ERROR_DS_HAVE_PRIMARY_MEMBERS | ERROR_DS_NAMING_MASTER_GC |
ERROR_DS_STRING_SD_CONVERSION_FAILED
The schema cache must convert the class SDDL into a security descriptor
ERROR_DS_STRING_SD_CONVERSION_FAILED indicates that a classSchema object contains a defaultSecurityDescriptor string that Active Directory cannot convert into a valid security descriptor. This SDDL value supplies the default owner, group, DACL, and SACL behavior for new instances of the class; it is not merely documentation attached to the schema.
Validate the complete SDDL string with Windows security-descriptor APIs and verify every SID alias, ACE type, access mask, object GUID, delimiter, and inheritance flag. Compare the stored value on all schema replicas if the failure appears during schema-cache reload. Do not simply remove the descriptor: that changes the default authorization model for future objects. Correct the class definition in a test forest, confirm that a new instance receives the intended ACL, and then deploy through a controlled schema update.
Security-descriptor evidence
- Exact defaultSecurityDescriptor string.
- Parser error from an SDDL conversion API.
- Class schemaIDGUID and intended access rights.
- Resulting ACL on a newly created test object.
References
Looking for a different code? Search another status or error code.