0X00002136: Can't Lock Tree for Delete in AD

Cause #1: Replication Conflict on Domain Controller

This is the most common cause. Happens when two domain controllers (DCs) have different versions of the same object, and one DC tries to delete it while the other hasn't replicated the change yet. You'll see this error when you try to delete an OU, a user, or a group from Active Directory Users and Computers (ADUC) and it fails with 0X00002136. The DC you're on thinks it can't lock the tree because another DC holds a stale copy.

Fix: Force Replication and Clear Metadata

1. Open Active Directory Sites and Services on the DC you're working from. Go to Sites > your site > Servers > your DC name > NTDS Settings.
2. Right-click the connection to the partner DC and choose Check Replication Topology. Wait a few seconds. You should see a message that topology is up to date.
3. Right-click that same connection again and choose Replicate Now. A box pops up—click OK. After a moment you should get a success message: "Replication was initiated successfully."
4. Now open Command Prompt as Administrator. Type: ntdsutil and press Enter.
5. Type: metadata cleanup and press Enter.
6. Type: remove selected server. It'll ask for the server name—type the FQDN of the DC that's causing issues (like DC02.yourdomain.local). Confirm when prompted. You should see "Operation completed successfully."
7. Type quit twice to exit.
8. Now go back to ADUC, right-click the object you were trying to delete, and choose Delete. It should work this time. If not, move to Cause #2.

Cause #2: FSMO Role Issues – PDC Emulator Not Reachable

When you delete an object, the DC needs to contact the PDC Emulator FSMO role holder. If that DC is offline, has DNS problems, or is unreachable, the delete fails with 0X00002136. This happens a lot after a DC crash or when someone turns off a server without transferring roles first.

Fix: Transfer or Seize the PDC Emulator Role

1. Open Active Directory Users and Computers. Right-click the domain name at the top and choose Change Domain Controller. Pick a DC that's online and working. Click OK.
2. Right-click the domain name again, choose Operations Masters. Click the PDC tab. You'll see the current role holder listed. If it's the same DC you just changed to, skip to step 5.
3. Click Change. A warning box appears—click Yes. You should see "Operations Master successfully transferred."
4. Close the Operations Masters window.
5. Test the delete again in ADUC. If it still fails, we need to seize the role because the old PDC is dead. On the working DC, open Command Prompt as Administrator. Type: ntdsutil and press Enter.
6. Type: roles and press Enter.
7. Type: connections and press Enter.
8. Type: connect to server DC01.yourdomain.local (replace with your working DC). You should see "Binding to DC01.yourdomain.local... Connected."
9. Type: quit to go back to the FSMO maintenance menu.
10. Type: seize PDC. It'll warn you—type yes. You should see "Transfer of PDC... successful."
11. Type quit twice to exit.
12. Now try the delete again. It should go through.

Cause #3: Lingering Object from a Former DC

Sometimes a DC is removed improperly (not demoted, just wiped or turned off). Its objects remain in AD as "lingering objects." These can't be deleted normally because AD thinks they're still valid. The error 0X00002136 pops up when you try to clean them up. You'll notice this if you see old DCs in AD Sites and Services that you can't remove.

Fix: Remove Lingering Objects with repadmin

1. Open Command Prompt as Administrator on a working DC.
2. First, find the GUID of the lingering object. Run: repadmin /showobjmeta * "CN=NameOfOldDC,CN=Servers,CN=SiteName,CN=Sites,CN=Configuration,DC=yourdomain,DC=local". Replace the path with the actual DN of the old DC. You'll get a list of attributes and timestamps. Look for the objectGUID line—copy that GUID.
3. Now remove the lingering reference. Run: repadmin /removelingeringobjects DC02.yourdomain.local DC=yourdomain,DC=local /advisory_mode. Replace DC02 with your working DC. This runs in advisory mode first—it'll show you the lingering objects without deleting them. You should see a list of objects marked as lingering.
4. If it looks correct, run the command again without /advisory_mode: repadmin /removelingeringobjects DC02.yourdomain.local DC=yourdomain,DC=local. You'll see "Removed X lingering objects."
5. Open ADSI Edit (install it via Server Manager if needed). Connect to the Configuration partition. Navigate to CN=Configuration,CN=Sites,CN=Default-First-Site-Name,CN=Servers. Delete the old DC object there. Right-click and choose Delete—it should work now.
6. Go back to ADUC and try the original delete. Should be good.

Quick-Reference Summary Table

If none of these work, check DNS. Make sure all DCs can resolve each other's names. Also check time sync—Kerberos hates a clock skew. Run w32tm /query /status on each DC to confirm they're within 5 minutes of each other. That's the edge case, but I've seen it.