| Previous | Next |
| ERROR_DS_MODIFYDN_WRONG_GRANDPARENT | ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER |
ERROR_DS_NAME_ERROR_TRUST_REFERRAL
ERROR_DS_NAME_ERROR_TRUST_REFERRAL means name resolution reached an object namespace in an external trusted forest. It is not a completed translation and it is not equivalent to a local-domain lookup failure. The caller must be prepared to follow the referral through the forest-trust path with an appropriate directory bind and security context.
Why a referral is generated
The DS_NAME_FLAG_TRUST_REFERRAL flag enables cross-forest trust referral for DsCrackNames. Forest trust data includes routed domain, UPN, SPN, and SID namespaces. When the requested name belongs outside the current forest, the local directory can provide a route rather than pretending that its own catalog is authoritative for that object.
What to verify before following it
- Record the original bind target, the name format, and the target forest or domain supplied by the referral path.
- Verify the forest trust, name-suffix routing, DNS discovery, and reachability of the destination domain controllers or global catalog.
- Use a bind and credentials that are valid for the destination forest; a successful referral does not grant access to the object.
- Keep cross-forest handling explicit in the client. Do not turn a referral into an unbounded retry loop or silently search unrelated forests.
Compare this status with DOMAIN_ONLY. That result provides a domain route when the object was not completely resolved in the current forest context; TRUST_REFERRAL specifically identifies the external-trust boundary.
Microsoft: DS_NAME_FLAG_TRUST_REFERRAL
Microsoft: forest trust namespaces and routing
RFC 4512: LDAP directory naming model
Looking for a different code? Search another status or error code.