| Previous | Next |
| ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE | ERROR_DS_SENSITIVE_GROUP_VIOLATION |
ERROR_DS_SAM_INIT_FAILURE
The security-account subsystem could not initialize with directory services
On a domain controller, account and security-principal processing is tightly coupled to AD DS. A SAM initialization failure is therefore a startup-critical condition and can prevent the DC from servicing authentication or directory operations. The embedded secondary status and Directory Service event are essential because this code is a wrapper around the lower-level initialization failure.
Microsoft directs recovery of an Active Directory server through Directory Services Restore Mode when offline directory repair or restore is required. In DSRM, AD DS is not running and local validation uses the registry SAM, giving administrators a controlled environment for database, log, and configuration diagnostics. Preserve the underlying status before rebooting and avoid treating the wrapper code as evidence that the SAM database alone is corrupt.
What to inspect
- Record the secondary error status and relevant startup events.
- Use DSRM for offline AD DS repair or restore when normal directory startup is unsafe.
- Check database, transaction-log, storage, and configuration errors that occurred before SAM initialization stopped.
References
- Microsoft: restore an Active Directory server
- Microsoft: AD and AD LDS diagnostic event logging
- Microsoft: dcdiag
Looking for a different code? Search another status or error code.