What does Windows error code 8560 (ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A tree delete encountered a critical directory-service object that cannot be deleted.

Previous	Next
ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER	ERROR_DS_INIT_FAILURE_CONSOLE

ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ

ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ (8560) is an Active Directory Domain Services error. The requested tree delete encountered a critical Active Directory system object. AD DS blocks deletion of such objects to protect domain-controller, topology, or other essential directory state; the larger tree delete may already be only partially complete.

What to check

Inventory what was deleted and what remains before repeating the operation.
Identify critical objects and verify whether the target container was appropriate for bulk deletion.
Use supported recovery or cleanup procedures for system objects; do not remove their protection flags simply to complete the delete.

Useful command

Get-ADObject -SearchBase "<TargetDN>" -SearchScope Subtree -LDAPFilter "(isCriticalSystemObject=TRUE)" -Properties isCriticalSystemObject

Microsoft: Clean up AD DS server metadata · Microsoft: DCDiag · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.