What does Windows error code 8357 (ERROR_DS_NCNAME_MUST_BE_NC) mean?

ERROR_DS_NCNAME_MUST_BE_NC

An NC name must identify a real partition root

A naming-context name is not just any distinguished name. It identifies the root of a replicated directory partition. Active Directory uses NC boundaries to define replica trees, replication scope, and partition metadata, so an interior container or leaf object cannot be substituted merely because its DN is syntactically valid.

Compare this with ordinary LDAP operations: RFC 4511 allows a search base or ModifyDN target to be an entry within the directory tree. AD-specific APIs that request an NC name are asking for a partition identity instead. Confusing these two concepts is common in backup, replication, and topology tooling.

What to inspect

• Query rootDSE for known naming contexts and compare the supplied DN exactly with an NC head.
• Check the forest Partitions container and the corresponding crossRef rather than inferring partitions from DNS labels.
• If the caller intended an LDAP base DN, use the API parameter for an entry or search base instead of an NC parameter.

References

• MS-ADTS naming contexts
• MS-ADTS Partitions container
• RFC 4511 directory operations