| Previous | Next |
| ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED | ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER |
ERROR_DS_MUST_BE_RUN_ON_DST_DC
Security checks require local execution at the destination DC
Some SID-history migration steps are intentionally bound to the destination domain controller. The destination DC performs hard-coded authorization checks, writes the protected attribute, generates destination audit events, and establishes protected communication with the source domain controller. Running the call from an arbitrary server cannot provide the same trusted execution context.
Identify which system actually invokes the API and which DC owns the destination object. Run the supported migration component in the documented location, using destination-domain administrative authority and a healthy secure channel to the source. Do not replace the workflow with remote LDAP modification of sIDHistory; that bypasses the API’s administrator check, audit generation, and transport protections.
What to inspect
- Confirm the API is executing on the intended destination DC.
- Verify destination administrator authorization and auditing.
- Check protected RPC connectivity from destination to source.
References
- Microsoft: destination-DC authorization and transport
- MS-ADTS: domain controller and security principal
- Microsoft: privileged identity administration
Looking for a different code? Search another status or error code.