ODMAD Directory Sync Issue: unable to create users or groups. Error: "Write: Unable to create <NAME>, object already exists" (4321041)

A recurring issue has been observed involving the creation of users or groups within a specific site. In previous instances, the affected user objects were removed from the target domain, which temporarily resolved the problem. However, the issue continues to reoccur over time.

The primary error reported is:

Write: Unable to create <NAME>, object already exists

In some cases, the issue is also accompanied by the following error:

Write: Directory Operation Error (ConstraintViolation): 000021C8: AtrErr: DSID-03200E96, #1:
0: 000021C8: DSID-03200E96, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90290 (userPrincipalName)

This behavior suggests that the migration is encountering existing directory objects or conflicting attributes, such as a duplicate userPrincipalName (UPN), even after the original objects have been removed. Since the issue reappears over time, further investigation is needed to determine whether the objects are being recreated, lingering directory metadata is causing conflicts, or another process is introducing duplicate attributes into the target environment.

The error indicates that the user object already exists in the target domain. Key factors to investigate include:

1. Object Existence in Target: Confirm via PowerShell using the SAMAccountName or UserPrincipalName whether the object exists in the target domain.
2. Scope Misalignment:
   • The object was not read into Directory Sync because it resides in an Organizational Unit (OU) or Common Name (CN) that is not within the scope of the Read step.
   • Alternatively, the object is within scope but does not meet the matching criteria defined in the workflow’s Match step attribute mapping.

To resolve the issue:

1. Verify and Resolve Duplicates:

   • Check for duplicate objects in the target domain and take appropriate actions to resolve them.
   • Once duplicates are resolved, allow workflows to sync the changes.

2. Validate Target OU Scope:

   • Ensure the target environment includes the Default Target OU in the ‘Organizational Units’ tab of the ODM AD Environments section for the target domain.
   • Verify that all necessary OUs are listed and marked as in scope for this workflow.

3. Review Match Criteria:

   • Examine the source and target object attributes to ensure they contain a matching value that satisfies the workflow’s Match step.

4. Contact Us:

   • If the above steps do not resolve the issue, contact Product Support for further assistance.