What does Windows error code 8572 (ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4) mean?

ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4

The machine account was created pre-NT4. The account needs to be recreated.

ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4 is Windows status 8572 (0x0000217C) associated with a machine account whose creation predates the Windows NT 4 account model.

Likely impact: Join, authentication, delegation, and policy operations can remain unreliable until the legacy account is recreated.

Typical causes

• the account was retained from an old domain migration.
• the object was restored without all modern attributes.
• a provisioning tool reused an obsolete account.
• the caller assumes a freshly created computer object.

Troubleshooting steps

1. Verify that the account has modern machine-account attributes, secrets, and security semantics required by the requested operation.
2. Collect computer object DN and objectGUID and sAMAccountName, objectClass, and account-control flags.

Useful evidence

• Collect domain functional level and migration history.
• Collect the first LDAP extended diagnostic.

Recovery and retry

Recreate the machine account through supported domain-join or provisioning tooling, then establish a new secure channel.

Related errors

ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT concerns missing creation attributes; this value identifies a legacy account that already exists

Example

A restored lab domain contains an old computer object. Deleting and recreating only that account, then rejoining the workstation, gives it modern attributes and a working secure channel.

References

• Microsoft: exact Win32 system error range
• Microsoft: AD DS troubleshooting
• Microsoft: dcdiag