0X00002121: Active Directory Search Attribute Fail Fix

Quick Answer for Advanced Users

Run NTDSUtil, go into database mode, and run compact to fix corrupt indexes. Then check schema with repadmin /showattr.

Why This Happens

You're on a domain controller running Windows Server 2016 or 2019, and a search query for user attributes (like displayName or memberOf) fails with this error. The culprit is almost always a corrupted database index or a schema mismatch after a half-failed schema update. I've seen this after a power loss during a GC promotion or a botched schema extension from Exchange or Skype for Business. The database itself is fine — it's the indexes that went sideways.

Don't bother restarting the NTDS service or running a full ESENT repair yet. Those take forever and rarely fix it.

Fix Steps

1. Check system state first. Run dcdiag /test:systemlog in an elevated command prompt. Look for ESENT errors (event IDs 474, 475, 476). If you see those, skip to step 3.
2. Verify schema consistency. Open ADSI Edit, connect to the Schema partition, and check if any attributes have mismatched attributeID or attributeSyntax. Common broken ones: ms-Exch-OWA-Url or msRTCSIP-UserRoutingGroupId. If you find one, note the cn.
3. Rebuild the index. Use NTDSUtil:
   

   ntdsutil
   activate instance ntds
   files
   info

   
   Note the database path (usually C:\Windows\NTDS\ntds.dit). Then run compact to C:\temp\ntds.dit. This rebuilds all indexes. Copy the compacted file back: copy C:\temp\ntds.dit C:\Windows\NTDS\ntds.dit.
4. Restart and test. Reboot the DC. After it comes up, run repadmin /showattr . CN=Users,DC=yourdomain,DC=com /filter:objectClass=user /atts:displayName. If it returns data, you're set.

Alternative Fixes If That Fails

Option 1: Schema repair. If a specific attribute is broken, use ADSI Edit to delete it from the schema only if it's not in use. Then reimport the schema extension from a backup or the vendor. I've done this for broken Exchange schema — it works but be careful.

Option 2: ESENT repair (last resort). Run esentutl /p C:\Windows\NTDS\ntds.dit. This is risky — it can lose data. Only do this if NTDSUtil compact fails. Backup first.

Option 3: Promote a new DC. If the error keeps coming back after a week, demote the DC, format the system drive, and promote fresh. It's faster than chasing a ghost issue.

Prevention Tip

Before you run any schema extension — especially from Exchange, Lync, or third-party apps — take a full backup of the system state and test on a secondary DC. Schema updates that fail halfway are the number one cause of this error. Also, run ntdsutil integrity checks monthly on your PDCe. Keeps the indexes clean.