search for: flag_domain_disallow_move

...so that is correct. > Then rename is done and then systemFlags is set again to 2348810240 > and that fails with "Invalid attribute syntax". That is where it appears to go wrong, but 2348810240 is computed from: FLAG_DISALLOW_DELETE 2147483648 FLAG_DOMAIN_DISALLOW_RENAME 134217728 FLAG_DOMAIN_DISALLOW_MOVE 67108864 and if you add up all the numbers, you get 2348810240, so that should be correct. Have you checked the ldif for abnormalities ? Spaces etc. My domain is running at functional level 2016, upgraded from 2008R2 when I upgraded to 4.21.0, when I checked my 'CN=Privileged Access Managemen...

...oft Schema-Updates.md documentation. In which Samba Schema-Updates.md is based. FLAG_CONFIG_ALLOW_RENAME is actually 0x4000 0000. > That is where it appears to go wrong, but 2348810240 is computed from: > > FLAG_DISALLOW_DELETE 2147483648 > FLAG_DOMAIN_DISALLOW_RENAME 134217728 > FLAG_DOMAIN_DISALLOW_MOVE 67108864 > > and if you add up all the numbers, you get 2348810240, so that should > be correct. Have you checked the ldif for abnormalities ? Spaces etc. > And "Expiring Group Membership Feature" originally had same systemFlags. It is actually added in same transaction (...