What does Windows error code 8611 (ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL) mean?

ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL

The target container for a redirection of a well known object container cannot already be a special container.

ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL is Win32 error 8611 (0x000021A3).

Likely impact: Using special containers as redirection targets can create ambiguous well-known-object ownership.

Typical causes

• the target is already marked as a special container.
• the script selects Users, Computers, or another protected target.
• well-known object metadata is stale.
• an OU was converted or restored with special semantics.

Troubleshooting steps

1. Verify that the new redirection target is a normal eligible container rather than another protected well-known container.
2. Collect target DN and wellKnownObjects metadata and current redirection mapping.

Useful evidence

• Collect redircmp or redirusr command arguments.
• Collect replication state of the domain root.

Recovery and retry

Create or select a normal OU that meets redirection requirements, then update the well-known container mapping.

Related errors

ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER blocks operations under System; this code specifically rejects a redirection target that is already special

Example

An administrator tries to redirect new computers into another built-in special container. Creating a dedicated OU and redirecting to it succeeds.

References

• Microsoft: exact Win32 system error range
• Microsoft: AD DS troubleshooting
• Microsoft: dcdiag