Return
-
Title
"A constraint violation has occurred." error message encountered when synchronizing User objects between two Active Directory domains -
Description
When synchronizing User accounts between two Active Directory domains, account creation fails with the following error message:
A constraint violation has occurred.
On the target Active Directory Domain Controller, the following error message is shown in the Directory Service Event Viewer logs:
The attribute value provided is not unique in the forest or partition. Attribute: userPrincipalName Value=userPrincipalName@domain.netCN=userPrincipalName,OU=Organizational Unit,,DC=domain,DC=net Winerror: 8648See http://go.microsoft.com/fwlink/?LinkID=279782 for more details on this policy. -
Cause
There is a two-way transitive trust in place between the source and target Active Directory domains. In this configuration, there is a uniqueness constraint on the UPN attribute which is enforced forest-wide. -
Resolution
Remove the userPrincipalName attribute from the Forward Sync Rules within the Active Roles Synchronization Service or modify the value which is written so that it is unique.