| Previous | Next |
| ERROR_DS_INIT_FAILURE_CONSOLE | ERROR_DS_FOREST_VERSION_TOO_HIGH |
ERROR_DS_SAM_INIT_FAILURE_CONSOLE
The domain controller cannot continue because its security-account initialization failed
This status is the console-facing form of a startup-critical SAM failure on a domain controller. The important diagnostic data is the secondary status embedded in the event or dialog. On a DC, security-principal processing depends on directory initialization, so a preceding NTDS database, log, schema, or configuration problem can surface when SAM startup is attempted.
Use Directory Services Restore Mode when offline repair or restore is required. In DSRM, AD DS is not running and authentication uses the local registry SAM, which is intentionally separate from normal domain-controller account processing. Do not reset domain accounts, recreate directory files, or copy registry hives merely because the text names SAM; first trace the secondary error back to the subsystem that failed earlier in startup.
What to inspect
- Preserve the secondary error code and first startup event in the chain.
- Check NTDS database and log status before assuming a standalone SAM corruption.
- Use DSRM credentials and supported restore procedures for offline recovery.
References
- Microsoft: restore an Active Directory server
- Microsoft: AD and AD LDS diagnostic event logging
- Microsoft: troubleshoot AD schema mismatch
Looking for a different code? Search another status or error code.