What does Windows error code 8359 (ERROR_DS_CLASS_MUST_BE_CONCRETE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Only a structural object class can be instantiated.

Previous	Next
ERROR_DS_CANT_ADD_SYSTEM_ONLY	ERROR_DS_INVALID_DMD

ERROR_DS_CLASS_MUST_BE_CONCRETE

Only a structural class can create a directory object

ERROR_DS_CLASS_MUST_BE_CONCRETE means the operation attempted to instantiate a class that is not structural. LDAP schema models distinguish abstract classes, which provide a common definition, structural classes, which form actual directory entries, and auxiliary classes, which extend another class with additional attributes.

In AD DS terms, an object needs a structural class in its class chain. An abstract class is a base for other classes, while an auxiliary class adds capabilities to an existing structural entry. Neither is a standalone object type for a normal LDAP add operation.

How to correct the model

Inspect the class's objectClassCategory and its subClassOf relationship in the schema.
Create the entry using the intended structural class, then add a permitted auxiliary class only where the schema design allows it.
Verify required attributes for the structural class, including its naming attribute and any inherited mustContain values.
For a custom integration, review the vendor's LDIF rather than inventing a new category solely to make the add operation succeed.

Why this is not an access-denied condition

Administrative privileges do not allow an abstract or auxiliary class to become instantiable. The server rejects it because the directory information model has no structural object definition to create.

References

Looking for a different code? Search another status or error code.