| Previous | Next |
| ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER | ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH |
ERROR_DS_SRC_SID_EXISTS_IN_FOREST
The forest already contains the identity being imported
A forest is a security boundary for Active Directory SID uniqueness. Before adding a source SID to sIDHistory, the destination must ensure that the SID is not already used as an object’s primary SID or historical SID. Allowing the duplicate would let two directory objects represent the same authorization identity.
Search every domain in the destination forest for the complete SID, including objectSid and sIDHistory. Investigate whether the object was migrated previously, restored, or partially cleaned up after a failed migration. Do not delete the conflicting value until you understand which account owns current resource access. A duplicate may indicate that the requested migration is being repeated rather than a harmless naming collision.
What to inspect
- Search objectSid and sIDHistory forest-wide.
- Compare the existing object with the requested source principal.
- Resolve abandoned migration objects before importing the SID again.
References
- Microsoft: duplicate-SID and forest constraints
- MS-ADTS: SID and forest security principals
- Microsoft: restored security principals and memberships
Looking for a different code? Search another status or error code.