What does Windows error code 8649 (ERROR_DS_MISSING_FOREST_TRUST) mean?

ERROR_DS_MISSING_FOREST_TRUST

The operation failed because the addition/modification referenced an inbound forest-wide trust that is not present.

ERROR_DS_MISSING_FOREST_TRUST is Win32 error 8649 (0x000021C9) in Active Directory Domain Services.

Likely impact: The dependent directory value must not be committed without the trust that gives it meaning.

Typical causes

• the trust was never created.
• the direction does not include inbound forest-wide trust.
• the trust object was deleted or not replicated.
• the request references the wrong forest identity.

Troubleshooting steps

1. Verify that the referenced forest trust exists, is inbound in the required direction, and has replicated to the contacted DC.
2. Collect trustedDomain objects and trust direction and forest names and SIDs.

Useful evidence

• Collect netdom or trust API output.
• Collect the change that references the trust.

Recovery and retry

Create or repair the required forest trust through supported tools and verify replication before repeating the dependent modification.

Related errors

ERROR_TRUST_FAILURE reports a failing existing trust relationship; this code says the required forest trust is absent

Example

A routing change references a partner forest before the inbound trust is created. Establishing and validating the trust makes the modification eligible.

References

• Microsoft: exact Win32 system error range
• Microsoft: AD DS troubleshooting
• Microsoft: dcdiag
• Microsoft: repadmin