# Directory Assessment Error Messages
<a name="da-error-msgs"></a>

To create a hybrid directory, you need to a passed directory assessment. Directory assessments can fail for various reasons.

The following table shows directory assessment error messages and how to resolve them.


**Directory Assessment Error Messages & Resolutions**  

| Directory Assessment Error Message | Resolution | 
| --- | --- | 
| This assessment failed multiple tests on both managed instances. Investigate the failed tests by selecting each managed instance and resolving them in your on-premises directory. Then, create a new assessment. | One or more of the directory assessment tests failed for your self-managed AD. Review the [Assessment Test error messages](assessment_test_error-msgs.md) for more information on specific test failures and their resolutions. | 
| This assessment failed due to Internal Service Exception. Please retry by creating a new assessment or contact service for troubleshooting. | Try to create a new directory assessment. If you continue to experience this error, contact [Amazon Web Services Support](http://www.amazonaws.cn/support-plans/). | 
| This assessment failed due to missing permission to perform an action like `ec2:CreateSecurityGroup`, `ec2:DeleteSecurityGroup`, `ec2:CreateNetworkInterface`, `ec2:DeleteNetworkInterface`, `ec2:DescribeSubnets`, and `ec2:DescribeNetworkInterface`. | To create a directory assessment, your Amazon Web Services account needs the necessary [Amazon Web Services account permissions](create_hybrid_directory_prereqs.md#hybrid-dir-prereq-perms). | 
| This assessment failed due to missing permission to perform an action like `ssm:GetConnectionStatus`, `ssm:GetCommandInvocation`, `ssm:ListCommands`, `ssm:SendCommand`. | To create a directory assessment, you will need two Systems Manager nodes with the necessary [Amazon Web Services account permissions](create_hybrid_directory_prereqs.md#hybrid-dir-prereq-perms). | 
| This assessment failed as you've reached the limit on the number of network interfaces that you can create. For more information, see [Amazon VPC quotas](https://docs.amazonaws.cn/vpc/latest/userguide/amazon-vpc-limits.html). | To create a directory assessment, you must create a network interface and security groups. There are limits to the number of VPC resources you can create however you can adjust some of these limits. For more information, see [Amazon VPC quotas](https://docs.amazonaws.cn/vpc/latest/userguide/amazon-vpc-limits.html). | 
| This assessment failed as you have reached the limit on the number of security groups that you can create, or assign to an instance. For more information, see [Amazon VPC quotas](https://docs.amazonaws.cn/vpc/latest/userguide/amazon-vpc-limits.html). | To create a directory assessment, you must create a network interface and security groups. There are limits to the number of VPC resources you can create however you can adjust some of these limits. For more information, see [Amazon VPC quotas](https://docs.amazonaws.cn/vpc/latest/userguide/amazon-vpc-limits.htmll). | 
| This assessment failed. Unable to connect to customer instances from Amazon Systems Manager. | To create a directory assessment, you will need two Amazon Systems Manager nodes that have a connected status. See [Troubleshooting SSM Agent](https://docs.amazonaws.cn/systems-manager/latest/userguide/troubleshooting-ssm-agent.html).  | 
| This assessment failed multiple critical tests. Investigate the failed tests by selecting each managed instance and resolve them in your on-premises directory. Then, create a new assessment. | One or more of the directory assessment tests failed for your self-managed AD. Review the [Assessment Test error messages](assessment_test_error-msgs.md) for more information. |