What does Windows error code 8369 (ERROR_DS_CANT_MOD_SYSTEM_ONLY) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A system-owned Active Directory attribute cannot be modified directly.

Previous	Next
ERROR_DS_CROSS_NC_DN_RENAME	ERROR_DS_REPLICATOR_ONLY

ERROR_DS_CANT_MOD_SYSTEM_ONLY

ERROR_DS_CANT_MOD_SYSTEM_ONLY (8369) is an Active Directory Domain Services error. The directory service rejected a direct change to a system-owned attribute. Its value is controlled by Active Directory replication, topology, security, or another supported service path rather than by normal client modification.

What to check

Confirm the LDAP display name and the schema restriction before changing the script or tool.
Determine which supported operation owns the attribute lifecycle.
If the value looks incorrect, investigate the underlying directory, replication, or service condition instead of trying to overwrite it.

Useful command

Get-ADObject -Identity "<ObjectDN>" -Properties "<attributeName>"

Microsoft: Characteristics of AD attributes · Microsoft: Impact of schema changes · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.