| Previous | Next |
| ERROR_DS_CANT_MOD_PRIMARYGROUPID | ERROR_DS_NONSAFE_SCHEMA_CHANGE |
ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD
Base-schema definitions have stricter invariants than custom extensions
ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD is returned when a modification targets a schema object marked as part of the built-in infrastructure and violates protected invariants. Active Directory uses FLAG_SCHEMA_BASE_OBJECT in systemFlags to identify definitions whose names, class relationships, default categories, confidentiality settings, or other critical fields cannot be rewritten like ordinary custom schema objects.
Compare the requested LDIF modification with the current object and isolate the exact attribute being changed. Do not work around the check by directly editing the directory database or copying a schema object under a new DN. If an application needs additional data, define a new attribute or auxiliary class under a properly allocated OID and add it through supported extension rules. Test the extension in a separate forest and retain a rollback plan based on disabling or superseding custom definitions, not reverting protected base objects.
Fields to compare in the rejected modification
- systemFlags and base-object status.
- Changed cn, lDAPDisplayName, class relationship, or security field.
- Original and proposed LDIF records.
- Supported custom extension that can meet the requirement instead.
References
- MS-ADTS: safety checks for base-schema objects
- Microsoft: restrictions on schema extension
- Microsoft: forest-wide schema responsibilities
Looking for a different code? Search another status or error code.