| Previous | Next |
| ERROR_DOMAIN_SID_SAME_AS_LOCAL_WORKSTATION | ERROR_INCORRECT_ACCOUNT_TYPE |
ERROR_DS_UNDELETE_SAM_VALIDATION_FAILED
The recovered principal cannot reclaim its account-name value
Restoring a deleted security principal reactivates identity attributes that may have been reused while the object was deleted. Active Directory validates the recovered sAMAccountName and additional SAM account-name values against live objects. A collision prevents restoration because two active principals cannot safely expose the same legacy logon identity.
Inspect the deleted object’s last-known account names and search the domain for every live object using them. Decide whether to rename the live object, restore under a temporary unique name, or abandon the recovery. Also review UPN and SPN values, which have separate forest-wide uniqueness rules and can fail at a different stage. Preserve the deleted object’s GUID and SID when identity continuity is required.
What to inspect
- Read account-name attributes from the deleted object.
- Search the domain for live SAM-name conflicts.
- Check UPN and SPN uniqueness before the final restore.
References
- Microsoft: restoring deleted users and groups
- Microsoft: uniqueness checks during restore
- MS-ADTS: security principal identity
Looking for a different code? Search another status or error code.