What does Windows error code 8646 (ERROR_INCORRECT_ACCOUNT_TYPE) mean?

 
Previous Next
ERROR_DS_UNDELETE_SAM_VALIDATION_FAILED ERROR_DS_SPN_VALUE_NOT_UNIQUE_IN_FOREST

ERROR_INCORRECT_ACCOUNT_TYPE

The system is not authoritative for the specified account and therefore cannot complete the operation. Please retry the operation using the provider associated with this account. If this is an online provider please use the provider's online site.

Treat ERROR_INCORRECT_ACCOUNT_TYPE as a domain-specific result, not as a generic exception. For ERROR_INCORRECT_ACCOUNT_TYPE, diagnosis begins with the exact operation, target identity, server or process that produced it, and the earliest lower-level diagnostic available at the same timestamp.

Operational meaning

For ERROR_INCORRECT_ACCOUNT_TYPE, the key question is whether the request is handled by the provider that owns the account identity and credentials. The value describes an account operation sent to a provider that is not authoritative for that account type; it does not prove that the whole domain, DNS service, network, servicing stack, application package, or operating system has failed.

Likely impact: Local retries or privilege elevation cannot make the wrong provider authoritative. For ERROR_INCORRECT_ACCOUNT_TYPE, record the scope that was actually tested instead of escalating from one rejected object or phase to a system-wide outage.

Where this result appears

  • ERROR_INCORRECT_ACCOUNT_TYPE can appear while processing an account operation sent to a provider that is not authoritative for that account type.
  • ERROR_INCORRECT_ACCOUNT_TYPE can appear while an LDAP, replication, domain-join, schema, trust, or directory-management request.
  • ERROR_INCORRECT_ACCOUNT_TYPE can appear while a request routed to one particular domain controller whose replica and site state matters.
  • ERROR_INCORRECT_ACCOUNT_TYPE can appear while a management tool that translates LDAP extended diagnostics into a Win32 result.

Typical causes

  • For ERROR_INCORRECT_ACCOUNT_TYPE, a cloud account is sent to local SAM APIs.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, a domain account is treated as a local account.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, provider metadata is stale.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, the UI hides which identity provider owns the account.

Diagnostic sequence

  1. capture ERROR_INCORRECT_ACCOUNT_TYPE immediately after the failing or status-returning call and record whether the API uses Win32, DNS_STATUS, HRESULT conversion, or callback semantics.
  2. identify the exact target involved in an account operation sent to a provider that is not authoritative for that account type, including stable GUIDs, DNs, zone names, package identities, file hashes, policy names, or process identifiers as applicable.
  3. prove the state boundary: the request is handled by the provider that owns the account identity and credentials.
  4. collect account SID, UPN, and provider identifier and local, domain, or online account classification before restarting services, deleting objects, rebuilding packages, or changing policy.
  5. correlate requested operation with Directory Service events, Security events, LDAP extended error text, replication metadata, dcdiag output, repadmin output, and the caller trace.
  6. for ERROR_INCORRECT_ACCOUNT_TYPE, determine whether the result is a failure, warning, informational completion, continuation request, or marker constant before choosing retry behavior.
  7. for ERROR_INCORRECT_ACCOUNT_TYPE, after changing one responsible condition, repeat the same smallest operation and verify both success and absence of unintended partial effects.

Evidence to preserve

  • For ERROR_INCORRECT_ACCOUNT_TYPE, collect account SID, UPN, and provider identifier.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, collect local, domain, or online account classification.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, collect requested operation.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, collect provider discovery result.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, collect sign-in and provisioning history.

For ERROR_INCORRECT_ACCOUNT_TYPE, correlate this evidence with Directory Service events, Security events, LDAP extended error text, replication metadata, dcdiag output, repadmin output, and the caller trace. Preserve raw identifiers and the first detailed diagnostic: translating everything to 8646 can hide whether the cause was validation, topology, authorization, replication, policy, file I/O, packaging, or an intentional continuation state.

Recovery and retry

The recovery objective for ERROR_INCORRECT_ACCOUNT_TYPE is to redirect the operation to the authoritative local, domain, or online provider and preserve the original account identity.

For ERROR_INCORRECT_ACCOUNT_TYPE, retry only after the recorded boundary changes and prior completion is known. Read-only discovery for ERROR_INCORRECT_ACCOUNT_TYPE can usually be repeated with bounded backoff; directory mutations, DNS updates, policy installation, servicing actions, and PRI writes require a state check first. Backoff for ERROR_INCORRECT_ACCOUNT_TYPE cannot repair malformed input, unsupported structure, identity collision, missing authority, or incompatible package metadata.

Telemetry and support fields

  • For ERROR_INCORRECT_ACCOUNT_TYPE, record incorrect_account_type_operation — producing API, command, callback, or servicing phase.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, record incorrect_account_type_target — stable object, zone, policy, package, file, or account identity.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, record incorrect_account_type_state_before and incorrect_account_type_requested_state.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, record incorrect_account_type_first_status — earliest component-specific code before translation.
  • For ERROR_INCORRECT_ACCOUNT_TYPE, record incorrect_account_type_server, incorrect_account_type_process, UTC timestamp, and correlation ID.

A support bundle for ERROR_INCORRECT_ACCOUNT_TYPE should include decimal 8646, hexadecimal 0x000021C6, the smallest reproducible request, target identity, effective configuration, and evidence from the owning Windows component. When documenting ERROR_INCORRECT_ACCOUNT_TYPE, remove secrets from exported logs but keep SIDs, GUIDs, package-family names, record types, and hashes when they are needed to distinguish objects.

Difference from nearby results

ERROR_NO_SECRETS says the local store lacks secret material; this code explicitly says the system is not authoritative for the account This distinction determines whether the correct next step is input correction, topology repair, continuation, policy review, package rebuild, or no error handling at all.

Practical validation scenario

A password-management tool sends an online account to a local change-password API. Detecting provider ownership sends the user to the online provider instead. A negative test should reproduce ERROR_INCORRECT_ACCOUNT_TYPE with the responsible condition preserved; the recovery test should alter only that condition and confirm the intended final state.

Developer and administrator guidance

Developers should model ERROR_INCORRECT_ACCOUNT_TYPE explicitly in the result domain instead of collapsing every nonzero value into “failed.” Administrators should capture evidence before destructive remediation and use the component that owns an account operation sent to a provider that is not authoritative for that account type. Monitoring for ERROR_INCORRECT_ACCOUNT_TYPE should suppress range markers and classify warning, informational, cancellation, and continuation values separately from terminal failures.

References

Looking for a different code? Search another status or error code.