Yeah, that error's a pain. You're trying to modify a user or computer object and AD just says no. Let's get you fixed.
The Quick Fix (90% of the time)
Most of the time this happens when someone (or some script) already added that attribute and you're trying to add it again. The quickest way is to use ADSI Edit to remove the duplicate.
- Open ADSI Edit (type
adsiedit.mscin Run). - Right-click ADSI Edit in the left pane and choose Connect to…
- Select your domain (or leave as Default Naming Context).
- Drill down to the object that's failing. Usually
DC=yourdomain,DC=com→ CN=Users or where your user/computer lives. - Right-click the object → Properties.
- Find the attribute that's duplicated. It'll be in the list with a value already. Look for anything that appears twice.
- Select the attribute, click Remove. If there are multiple values, highlight the one you don't need.
- Click OK and try your original action again.
That's it. Wait a few seconds for replication if you have multiple DCs, then retry.
If You Don't See the Duplicate
Sometimes the attribute is hidden. Open the object's properties in ADSI Edit, click Filter and check Show all attributes. Also make sure you're looking at the right naming context – if you're editing a user in the domain, don't connect to the Configuration partition by mistake.
Why This Works
Active Directory is a database. Each object has a set of attributes, and each attribute can have one or more values depending on its schema definition. The error 0x0000207E literally means ERROR_DS_ATT_ALREADY_EXISTS – the schema says “this attribute is single-valued” but the system found more than one value already attached to the object.
This usually happens when you run a script that does something like Set-ADUser -Description $null and then try to set it again. Or when a third-party sync tool (like Azure AD Connect) tries to write a value that's already there. I had a client last month whose entire user provisioning script broke because someone manually added a mail attribute via ADSI Edit while the script was also trying to set it. Removing the extra value fixed it in two minutes.
By removing the duplicate in ADSI Edit, you're telling the directory to forget the old value and let your new write succeed.
Less Common Variations
Sometimes it's not just a duplicate. Here are other ways I've seen this error show up.
1. Schema Conflict After Domain Upgrade
If you recently upgraded from Server 2008 to 2012 or later, some old attributes get redefined. A dcpromo might fail with this error. In that case, use ADSI Edit to check the CN=Schema,CN=Configuration partition. Look for the attribute in question – see if isSingleValued is set to TRUE but there are legacy multi-values. You might need to escalate to a schema admin to clean it up.
2. Replication Lag
If you're on a multi-DC environment and you just deleted the value on one DC, but the error persists, it's because the change hasn't replicated. Force replication with:
repadmin /syncall /AdePAlso check repadmin /showqueue to see if there's a backlog.
3. Old Exchange Attributes
When you decommission Exchange but don't clean up the attributes, you can get this error when trying to modify a mailbox-enabled user. The msExchMailboxGUID or legacyExchangeDN might have leftover values. Remove them in ADSI Edit if they're not needed.
4. PowerShell Set-ADUser with Multiple Values
If you're using Set-ADUser -Add @{attribute=value} and the attribute already has that value, you'll get this error. Instead use -Replace or check first:
Get-ADUser -Identity username -Properties attribute | Select-Object -ExpandProperty attributeIf it returns a value, use -Replace to overwrite.
Prevention
Stop running the same script twice without checking what's already there. Write your scripts to be idempotent – test if the value exists before setting it. Use -Replace instead of -Add when you're not sure.
Also, don't let people manually edit AD with ADSI Edit unless they know what they're doing. That's how you get orphaned attributes. If you're using a sync tool, make sure it's configured to not overwrite existing values unless you intend it to.
Keep an eye on replication health. A healthy AD won't have these weird errors. Run dcdiag quarterly.
Now go fix it. You got this.