What does Windows error code 8478 (ERROR_DS_DS_REQUIRED) mean?

Previous	Next
ERROR_DS_DRA_REPL_PENDING	ERROR_DS_INVALID_LDAP_DISPLAY_NAME

ERROR_DS_DS_REQUIRED

The requested operation requires a directory service, and none was available.

The native value for ERROR_DS_DS_REQUIRED is 8478 (0x0000211E). Preserve ERROR_DS_DS_REQUIRED immediately after the failing Windows call because later logging, cleanup, LDAP, RPC, or file operations can replace the last-error value.

ERROR_DS_DS_REQUIRED belongs to Active Directory Domain Services (AD DS). A diagnosis of ERROR_DS_DS_REQUIRED must connect the condition to the producing API, current state, object identity, and first lower-level diagnostic.

Where this result appears

• For ERROR_DS_DS_REQUIRED, processing an operation that requires an available directory service.
• For ERROR_DS_DS_REQUIRED, executing an LDAP, RPC, deployment, replication, or directory-management operation.
• For ERROR_DS_DS_REQUIRED, working against a specific domain controller whose replica and schema state affect the result.
• For ERROR_DS_DS_REQUIRED, translating extended directory diagnostics into a Win32 error for an application or administration tool.

State boundary to prove

ERROR_DS_DS_REQUIRED applies to an operation that requires an available directory service and does not by itself prove that the entire server, directory, disk, session, or application is unavailable. The state boundary to prove for ERROR_DS_DS_REQUIRED is whether the target environment has a reachable AD DS or AD LDS service that owns the requested data or operation. Use operation and required directory role, DC locator result, and DNS SRV queries as independent evidence. When evidence for ERROR_DS_DS_REQUIRED disagrees, preserve timestamps and investigate the transition instead of selecting the most convenient value.

Likely causes

• For ERROR_DS_DS_REQUIRED, the machine is offline or not domain-connected.
• For ERROR_DS_DS_REQUIRED, DC discovery fails.
• For ERROR_DS_DS_REQUIRED, the selected server is not a directory service.
• For ERROR_DS_DS_REQUIRED, the required AD LDS instance is stopped.

Diagnostic sequence

1. For ERROR_DS_DS_REQUIRED, capture error 8478 immediately at the API boundary and record the operation that was attempted.
2. For ERROR_DS_DS_REQUIRED, identify the exact owner of an operation that requires an available directory service, including object generation, server, path, session, replica, or client context.
3. For ERROR_DS_DS_REQUIRED, collect operation and required directory role before restarting a service or changing configuration.
4. For ERROR_DS_DS_REQUIRED, compare DC locator result with the documented or observed precondition.
5. For ERROR_DS_DS_REQUIRED, correlate DNS SRV queries with the Directory Service event log, LDAP extended diagnostics, replication metadata, dcdiag and repadmin output, and the calling application’s request trace.
6. For ERROR_DS_DS_REQUIRED, determine whether side effects occurred and verify recovery after changing one responsible condition.

Evidence to collect

• For ERROR_DS_DS_REQUIRED, operation and required directory role.
• For ERROR_DS_DS_REQUIRED, DC locator result.
• For ERROR_DS_DS_REQUIRED, DNS SRV queries.
• For ERROR_DS_DS_REQUIRED, service and network state.
• For ERROR_DS_DS_REQUIRED, domain/forest context.

Correlate ERROR_DS_DS_REQUIRED with the Directory Service event log, LDAP extended diagnostics, replication metadata, dcdiag and repadmin output, and the calling application’s request trace. Keep the first detailed status even when a later wrapper translates it to error 8478; the first status often distinguishes transport, authorization, storage, schema, state, and application-integrity causes that share the same final Win32 result.

Handling, retry, and recovery

For ERROR_DS_DS_REQUIRED, the recovery objective is to restore directory availability or target the correct directory instance; provide an explicit offline path when the operation can be deferred.

Retry ERROR_DS_DS_REQUIRED only after the recorded condition changes and completion state is known. For ERROR_DS_DS_REQUIRED, idempotent queries may be repeated after recovery, but mutations require a state check first; backoff cannot repair malformed input, corruption, missing structure, or policy rejection.

Telemetry and support fields

• For ERROR_DS_DS_REQUIRED, record ds_ds_required_api for the producing function or management operation.
• For ERROR_DS_DS_REQUIRED, record ds_ds_required_target for the file, log, session, replica, object, or server identity.
• For ERROR_DS_DS_REQUIRED, record ds_ds_required_state_before and ds_ds_required_requested_transition.
• For ERROR_DS_DS_REQUIRED, record ds_ds_required_first_status for the earliest lower-level diagnostic.

For support escalation involving ERROR_DS_DS_REQUIRED, retain decimal 8478, hexadecimal 0x0000211E, the API, UTC time, target identity, and first subsystem-specific status. For ERROR_DS_DS_REQUIRED, include the smallest reproducible request and evidence that distinguishes this condition from nearby codes. In the context of ERROR_DS_DS_REQUIRED, many ds codes are internal or management-facing and are not tied to one public function. the producing ldap, rpc, deployment, or management api must therefore be recorded with the code.

Difference from nearby results

For ERROR_DS_DS_REQUIRED, ERROR_NO_LOGON_SERVERS is authentication-focused; this code applies more broadly to operations requiring a directory service

Practical validation scenario

A policy tool runs on a workgroup machine and requests domain directory data. It reports the missing directory dependency instead of searching local files for a substitute. The negative test should preserve the responsible condition and reproduce ERROR_DS_DS_REQUIRED; the recovery test should change only the identified cause, repeat the same operation, and verify both success and the absence of an unintended partial side effect.

Developer and administrator guidance

Administrators handling ERROR_DS_DS_REQUIRED should preserve Directory Service events, replication metadata, and the contacted domain controller before changing objects or forcing role transitions. For ERROR_DS_DS_REQUIRED, developers should retain LDAP extended diagnostics and object identities across wrappers so the Win32 code does not erase the actionable directory result. Code that exposes ERROR_DS_DS_REQUIRED through RPC, JSON, REST, PowerShell, or another protocol should preserve the Win32 domain, decimal 8478, hexadecimal 0x0000211E, and original component diagnostic.

References

• Microsoft: Win32 system error range containing this code — official context relevant to ERROR_DS_DS_REQUIRED.
• Microsoft: AD DS troubleshooting — official context relevant to ERROR_DS_DS_REQUIRED.
• Microsoft: repadmin — official context relevant to ERROR_DS_DS_REQUIRED.
• Microsoft: dcdiag — official context relevant to ERROR_DS_DS_REQUIRED.
• Microsoft: AD and LDS diagnostic event logging — official context relevant to ERROR_DS_DS_REQUIRED.

---

Looking for a different code? Search another status or error code.