| Previous | Next |
| ERROR_DS_COULDNT_CONTACT_FSMO | ERROR_DS_CANT_MOD_SYSTEM_ONLY |
ERROR_DS_CROSS_NC_DN_RENAME
ModifyDN does not make an ordinary cross-NC move valid
LDAP ModifyDN can change an entry’s RDN and can request a new superior, but RFC 4511 explicitly allows a server to reject a move between naming contexts. Active Directory treats NCs as separate replicated partitions. Reparenting an object from one NC to another is therefore not equivalent to an ordinary move within a domain partition.
This is why editing the DN string or changing only newSuperior does not bypass the restriction. Supported cross-domain moves have additional rules for object identity, group memberships, source and destination authority, and synchronized forest partition metadata. An LDAP client must distinguish a local ModifyDN from an AD cross-domain move workflow.
What to inspect
- Compare the source and destination NC heads, not just their parent OU names.
- If both parents are in the same NC, inspect the generated DN and LDAP request for an unintended target.
- For a real cross-domain move, use an AD operation designed for that workflow and validate source/destination replication before retrying.
References
Looking for a different code? Search another status or error code.