| Previous | Next |
| ERROR_DS_DRA_RECYCLED_TARGET | ERROR_DS_HIGH_ADLDS_FFL |
ERROR_DS_DISALLOWED_NC_REDIRECT
The redirect target crosses a naming-context boundary
Active Directory uses naming contexts as replication and authority boundaries. Some redirection operations are specifically constrained to the domain NC of the current domain controller. A target object in another NC cannot be substituted even if the DN is valid and the forest trusts both partitions.
This is a partition-scope rule, not an HTTP-style redirect or a generic LDAP referral failure. The client should compare the current domain NC and the target object’s NC head. Choosing a server in the wrong domain can also make an otherwise intended domain-local redirect appear cross-NC.
What to inspect
- Resolve the target DN to its NC head and compare it with the current DC’s domain naming context.
- Verify the operation is sent to a DC for the domain in which the redirect is supposed to be established.
- Keep the redirect target inside the permitted domain NC; use the correct forest/domain-specific mechanism when the business requirement actually spans partitions.
References
- MS-ADTS naming-context and domain-NC definitions
- MS-DRSR NC replica model
- RFC 4511 naming and referral model
Looking for a different code? Search another status or error code.