| Previous | Next |
| ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST | ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN |
ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED
Mandatory destination auditing is missing
Adding SID history changes authorization behavior because old SIDs can continue to satisfy access-control entries. Microsoft therefore requires auditing in both source and destination domains for DsAddSidHistory. The destination DC must be able to record success and failure of the operation; this is a security prerequisite, not optional troubleshooting telemetry.
Check effective audit policy on the destination domain controller that executes the call, including success and failure auditing for account management. Confirm that policy has applied and that the Security log can accept events. Do not bypass the check by modifying objects directly: writing sIDHistory outside the protected API path defeats the authorization, transport protection, and audit guarantees described for the migration operation.
What to inspect
- Verify effective account-management auditing on the destination DC.
- Confirm Security log health and policy application.
- Run the operation against the intended destination controller.
References
- Microsoft: mandatory auditing for DsAddSidHistory
- Microsoft: privileged identity change protection
- MS-ADTS: security principal and SID terminology
Looking for a different code? Search another status or error code.