| Previous | Next |
| ERROR_DS_CLASS_MUST_BE_CONCRETE | ERROR_DS_OBJ_GUID_EXISTS |
ERROR_DS_INVALID_DMD
The schema must be located through the directory, not a hard-coded DN
ERROR_DS_INVALID_DMD indicates that Active Directory could not resolve the schema object that anchors the forest schema naming context. The schema is a replicated directory partition whose root is a dMD object; clients should discover its distinguished name from the schemaNamingContext attribute on rootDSE rather than constructing a path from assumptions about the forest layout.
Verify the server and directory instance first, because AD DS and AD LDS can expose different schema naming contexts. Read rootDSE, bind to the returned DN, and confirm that the object is accessible as the schema root before retrying a class or attribute operation. If the bind fails on one domain controller but succeeds on another, investigate replication or local database health instead of recreating schema objects. A stale cached DN, an AD LDS configuration-set mismatch, or querying the wrong LDAP endpoint can all produce a lookup that appears to be a missing schema.
Evidence to capture before changing the schema
- LDAP server and port used by the client.
- rootDSE schemaNamingContext returned by that server.
- Object class and DN returned for the schema root.
- Whether the same bind succeeds on another replica.
References
- Microsoft: bind to formal schema definitions
- Microsoft: forest-wide Active Directory schema
- IETF RFC 4512: subschema and root DSE model
Looking for a different code? Search another status or error code.