What does Windows error code 8605 (ERROR_DS_DUPLICATE_ID_FOUND) mean?

Previous	Next
ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC	ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT

ERROR_DS_DUPLICATE_ID_FOUND

The requested object has a non-unique identifier and cannot be retrieved.

Windows assigns decimal 8605 and hexadecimal 0x0000219D to ERROR_DS_DUPLICATE_ID_FOUND. The constant belongs to Active Directory Domain Services; its name is not enough to identify the affected directory object, DNS zone, policy, installer, package, or resource context.

Operational meaning

The key question is whether exactly one live object owns the requested identifier. The value describes lookup of a directory object by an identifier expected to be unique; it does not prove that the whole domain, DNS service, network, servicing stack, application package, or operating system has failed.

Likely impact: Selecting an arbitrary match can update or authorize the wrong directory object. Record the scope that was actually tested instead of escalating from one rejected object or phase to a system-wide outage.

Where the result appears

• This result can appear while processing lookup of a directory object by an identifier expected to be unique.
• This result can appear while an LDAP, replication, domain-join, schema, trust, or directory-management request.
• This result can appear while a request routed to one particular domain controller whose replica and site state matters.
• It can appear while a management tool that translates LDAP extended diagnostics into a Win32 result.

Typical causes

• duplicate identifiers were introduced by restore or migration.
• conflicting objects exist on different replicas.
• an application reused an external identifier.
• replication has not converged after conflict resolution.

Diagnostic sequence

1. capture it immediately after the failing or status-returning call and record whether the API uses Win32, DNS_STATUS, HRESULT conversion, or callback semantics.
2. identify the exact target involved in lookup of a directory object by an identifier expected to be unique, including stable GUIDs, DNs, zone names, package identities, file hashes, policy names, or process identifiers as applicable.
3. prove the state boundary: exactly one live object owns the requested identifier.
4. collect identifier value and attribute name and DN, GUID, and replication metadata of every match before restarting services, deleting objects, rebuilding packages, or changing policy.
5. correlate conflict objects and deleted-object state with Directory Service events, Security events, LDAP extended error text, replication metadata, dcdiag output, repadmin output, and the caller trace.
6. determine whether the result is a failure, warning, informational completion, continuation request, or marker constant before choosing retry behavior.
7. after changing one responsible condition, repeat the same smallest operation and verify both success and absence of unintended partial effects.

Evidence to preserve

• collect identifier value and attribute name.
• collect DN, GUID, and replication metadata of every match.
• collect conflict objects and deleted-object state.
• collect originating DC and USN.
• collect application provisioning history.

Correlate this evidence with Directory Service events, Security events, LDAP extended error text, replication metadata, dcdiag output, repadmin output, and the caller trace. Preserve raw identifiers and the first detailed diagnostic: translating everything to 8605 can hide whether the cause was validation, topology, authorization, replication, policy, file I/O, packaging, or an intentional continuation state.

Recovery and retry

The recovery objective for it is to identify the authoritative object, repair duplicate values through a controlled migration, and allow replication to converge before lookup resumes.

Retry only after the recorded boundary changes and prior completion is known. Read-only discovery for it can usually be repeated with bounded backoff; directory mutations, DNS updates, policy installation, servicing actions, and PRI writes require a state check first. Backoff for it cannot repair malformed input, unsupported structure, identity collision, missing authority, or incompatible package metadata.

Telemetry and support fields

• record ds_duplicate_id_found_operation — producing API, command, callback, or servicing phase.
• record ds_duplicate_id_found_target — stable object, zone, policy, package, file, or account identity.
• record ds_duplicate_id_found_state_before and ds_duplicate_id_found_requested_state.
• record ds_duplicate_id_found_first_status — earliest component-specific code before translation.
• record ds_duplicate_id_found_server, ds_duplicate_id_found_process, UTC timestamp, and correlation ID.

A support bundle for it should include decimal 8605, hexadecimal 0x0000219D, the smallest reproducible request, target identity, effective configuration, and evidence from the owning Windows component. When documenting it, remove secrets from exported logs but keep SIDs, GUIDs, package-family names, record types, and hashes when they are needed to distinguish objects.

Difference from nearby results

ERROR_DS_NAME_NOT_UNIQUE concerns a requested name; this code identifies a non-unique object identifier used for retrieval This distinction determines whether the correct next step is input correction, topology repair, continuation, policy review, package rebuild, or no error handling at all.

Practical validation scenario

Two migrated users share an application ID. Clearing the value on the obsolete object and verifying replication restores deterministic lookup. A negative test should reproduce it with the responsible condition preserved; the recovery test should alter only that condition and confirm the intended final state.

Developer and administrator guidance

Developers should model it explicitly in the result domain instead of collapsing every nonzero value into “failed.” Administrators should capture evidence before destructive remediation and use the component that owns lookup of a directory object by an identifier expected to be unique. Monitoring for it should suppress range markers and classify warning, informational, cancellation, and continuation values separately from terminal failures.

References

• Microsoft: exact Win32 system error range — official context relevant to it.
• Microsoft: AD DS troubleshooting — official context relevant to it.
• Microsoft: dcdiag — official context relevant to it.
• Microsoft: repadmin — official context relevant to it.

---

Looking for a different code? Search another status or error code.