| Previous | Next |
| ERROR_DS_ATT_NOT_DEF_FOR_CLASS | ERROR_DS_CANT_ADD_ATT_VALUES |
ERROR_DS_ATT_ALREADY_EXISTS
Attribute presence is separate from attribute values
ERROR_DS_ATT_ALREADY_EXISTS is raised while Active Directory is applying a directory modification and the operation tries to add an attribute that the entry already has. It is not a statement that the object itself already exists, and it is not necessarily the same condition as adding a duplicate value to a multi-valued attribute.
In LDAP, an entry is a set of attributes, each with zero or more values. A provisioning workflow can reach this status when an add change is replayed after a timeout, when two reconciliation jobs act on the same entry, or when a client emits an add change where a replace or an idempotent comparison was required.
What to examine
- Read the current entry immediately before the failing write and compare the requested attribute names with the existing attribute set.
- Preserve the LDAP modify operation in logs: the distinction between
add,delete, andreplacechanges the interpretation of the failure. - For retryable provisioning, use a read-compare-write pattern or make the desired final state explicit instead of replaying an unconditional add.
- Do not treat this as a schema-extension failure unless the attribute is also absent from
attributeSchema; this code concerns the target object state.
Related distinction
ERROR_DS_ATT_VAL_ALREADY_EXISTS concerns a value that duplicates an existing value. This status concerns the attribute slot itself. The two should be separated in diagnostics because they require different changes to the client request.
References
- RFC 4511: LDAP Modify and Add operations
- RFC 4512: LDAP directory information models and attribute values
- Microsoft: Active Directory schema implementation
Looking for a different code? Search another status or error code.