| Previous | Next |
| ERROR_DS_RANGE_CONSTRAINT | ERROR_DS_CANT_REM_MISSING_ATT |
ERROR_DS_ATT_VAL_ALREADY_EXISTS
The duplicate is a value, not the attribute name
ERROR_DS_ATT_VAL_ALREADY_EXISTS means the requested value is already present for the specified attribute. It matters most for multi-valued attributes such as membership-like or identifier-like properties. The directory compares values under the attribute's equality rules, so two textual inputs that look different to an application can still be the same value to LDAP.
This commonly happens when a provisioning system retries an add change after losing the response, when two controllers perform the same enrollment concurrently, or when the client compares unnormalized data before issuing a change.
How to diagnose and design for it
- Read the existing values through LDAP and compare them using the attribute's documented equality semantics, not just a raw byte or case-sensitive string comparison.
- Log the operation type and exact value submitted, while redacting secrets and identifiers that should not be retained in application logs.
- Use a final-state reconciliation model for multi-valued attributes when possible: compute the intended set, then make only the required additions and removals.
- Distinguish a harmless retry from a collision with an unexpected writer by recording the workflow identity and object revision in the provisioning system.
Compare with nearby schema errors
This code does not say that the attribute is forbidden for the object class. It says that an allowed attribute already contains the value. A forbidden attribute produces ERROR_DS_ATT_NOT_DEF_FOR_CLASS instead.
References
- RFC 4511: atomic LDAP modifications and schema enforcement
- RFC 4512: equality matching and attribute values
- Microsoft: attributeSchema characteristics
Looking for a different code? Search another status or error code.