AD Group Sync Fails with "Invalid DN Syntax" on CNF Conflict Objects
Error: The distinguished name contains invalid syntax. The distinguished name was:
'CN=LAB_TestGroup_V2_Sync_Conflict
CNF:1a2bc345-0de6-7fgh-ijkl-0123456789ab,OU=Security,OU=Groups,OU=SITE01,OU=TESTDEPT,OU=LAB,DC=labdomain,DC=local'
Error during CreateObject
Object DN: CN=LAB_TestGroup_V2_Sync_Conflict
CNF:1a2bc345-0de6-7fgh-ijkl-0123456789ab,OU=Security,OU=Groups,OU=SITE01,OU=TESTDEPT,OU=LAB,DC=labdomain,DC=local
Object ID: 10500
Result code: InvalidDNSyntax
AD Exception: 0000208F: NameErr: DSID-03190952, problem 2006 (BAD_NAME), data 8349, best match of:
'CN=LAB_TestGroup_V2_Sync_Conflict
CNF:1a2bc345-0de6-7fgh-ijkl-0123456789ab,OU=Security,OU=Groups,OU=SITE01,OU=TESTDEPT,OU=LAB,DC=labdomain,DC=local'
The object cannot be provisioned in the target domain in its current state.
The object is an Active Directory replication conflict object (CNF). When two identically named objects were created on separate domain controllers simultaneously, AD's conflict resolution mechanism appended a CNF:<GUID> suffix to one of them, separated by a newline character (\n). While AD stores this internally, the resulting Distinguished Name is non-compliant with RFC 4514 LDAP DN syntax, causing DirSync to fail with InvalidDNSyntax on the LDAP AddRequest.
We propose the following steps:
1. Audit – Enumerate all CNF objects in the source domain using the LDAP filter (cn=*\0ACNF:*) to determine the full scope.
2. Review – Confirm with your team whether the conflict object holds any active group memberships that need to be preserved.
3. Remediate – Either rename the object to a valid CN and merge memberships, or remove it if it is a redundant duplicate.
4. Replication Health Check – Run repadmin /replsummary and repadmin /showrepl to identify and address the underlying replication issues that produced the conflict objects.
5. Re-run the DirSync job for affected objects once the source AD is clean.
