| Previous | Next |
| ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS | ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE |
ERROR_DS_NC_MUST_HAVE_NC_PARENT
Active Directory enforces a tree of naming contexts
Active Directory forests contain naming contexts arranged as a partition tree. A child NC head has to be directly subordinate to another NC head in that partition hierarchy. Placing a new partition root below an ordinary container would create a replicated partition boundary inside an interior node that is not itself a partition root.
This constraint is about NC topology, not LDAP DN syntax. The proposed DN can be perfectly legal as an entry name and the parent object can exist. The directory rejects the operation because the requested object is being created as an NC head and its immediate parent does not satisfy the partition model.
What to inspect
- Split the proposed DN into parent and child and determine whether the immediate parent is an existing NC head.
- Inspect crossRef metadata for the parent partition instead of assuming every domain-style DN component defines an NC.
- Create partition hierarchies top-down. Do not insert a new NC boundary under an arbitrary OU or container.
References
Looking for a different code? Search another status or error code.