0X0000219C: Writable NCs Block DC Demotion – Fix It

What's Actually Happening Here

You're trying to demote a domain controller, and you hit ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC (0X0000219C). The error message says it plainly: writable naming contexts (NCs) prevent this DC from demoting. But what does that mean in plain English?

Active Directory doesn't just store the main domain partition and the schema. Third-party apps, Exchange, or even old AD-integrated DNS zones can create application partitions — think of them as mini databases that live on DCs. When you demote a DC, AD checks: is this DC still hosting a writable copy of any application partition? If yes, demotion stops. The logic is sound — you don't want to orphan data. But when you're cleaning up a dead server or migrating, this check becomes a brick wall.

I've seen this most often when someone tries to demote a DC that once ran Exchange or had AD-integrated DNS from a different forest partition. The fix is procedural: find the partition, remove its replica from this DC, then demote. Let's walk through the three most common causes.

1. Leftover Application Partitions from Third-Party Apps

This is the #1 cause. Exchange, Sharepoint, or even a custom LOB app created an application partition and never cleaned it up. The DC still hosts a writable replica. You need to find and remove it.

Step-by-Step Fix

1. Open ADSI Edit (adsiedit.msc). Connect to the Configuration partition of the forest (right-click ADSI Edit > Connect to > Configuration).
2. Navigate to CN=Partitions,CN=Configuration,DC=yourdomain,DC=com.
3. In the right pane, look for objects with nCName that are not the default partitions (like DC=yourdomain,DC=com or CN=Schema). They'll look like DC=Exchange,CN=... or DC=something.
4. Right-click any suspicious partition, go to Properties, and check the msDS-NC-Replica-Locations attribute. If it lists your DC's NTDS Settings GUID, that DC hosts it.
5. Now open a command prompt as Administrator. Run ntdsutil.
6. At the ntdsutil: prompt, type partition management.
7. Type connections, then connect to server localhost (or your DC's FQDN), then quit.
8. Type list to see all writable NCs. Note the one matching the partition from step 3.
9. Remove it: remove nc replica "DC=Exchange,CN=..." "yourDC.yourdomain.com" — replace the quotes with the exact NC and your DC's FQDN.
10. Confirm when prompted. Type quit twice to exit ntdsutil.

Now rerun dcpromo or your demotion wizard. It should pass this check.

Why this works: The remove nc replica command tells AD this DC is no longer responsible for that partition. The demotion check then sees zero writable NCs and allows the process.

2. AD-Integrated DNS Zone Replicas Still Present

Less common but still a real pain. If you've ever had a DNS zone that was replicated to AD but you later removed it, the metadata can linger. The partition shows up as DC=ForestDnsZones,DC=yourdomain or DC=DomainDnsZones. You'd think those are built-in, and they are — but sometimes a stale replica from a failed zone transfer leaves the DC listed.

Step-by-Step Fix

1. Open DNS Manager (dnsmgmt.msc).
2. Right-click your server, go to Properties > Advanced. Check the Load zone data on startup — if it's set to From Active Directory and registry, you're fine.
3. Now check each zone under Forward Lookup Zones. Right-click a zone (like _msdcs.yourdomain.com) > Properties > General. Look at the Replication field. If it says All domain controllers in the domain, move on. If it says something like All DNS servers in this forest and you see your DC listed, check the Name Servers tab.
4. If your DC appears there but shouldn't, remove it. Then force replication: repadmin /syncall /AdeP.

If that doesn't clear the replica from the partition list, go back to the ADSI Edit method from Cause #1 and look for DC=ForestDnsZones or DC=DomainDnsZones. Check msDS-NC-Replica-Locations. If your DC is listed, use ntdsutil's remove nc replica as above.

Why this works: DNS zones in AD are stored as application partitions. Removing the replica from the partition metadata tells AD the DC no longer hosts that zone. The demotion check passes.

3. Stale Metadata from a Failed Demotion Attempt

Sometimes you get this error even after you've removed all visible partitions. What's actually happening is a previous demotion attempt failed halfway, leaving behind a partial replica in the metabase. AD thinks the DC still holds a writable NC, but you can't see it in ADSI Edit because it's corrupted or hidden.

Step-by-Step Fix

1. Open Registry Editor (regedit.exe).
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters.
3. Look for a multi-string value called Replica Naming Contexts. This lists all NCs the DC thinks it hosts.
4. Compare these to the list from ntdsutil partition management list. If you see an entry in the registry that doesn't appear in ntdsutil output, that's your culprit. It's orphaned.
5. Back up this key before making changes. Right-click > Export.
6. Delete just the orphaned entry from the Replica Naming Contexts value. Leave everything else.
7. Reboot the DC.

Why this works: The registry is the source of truth for what NCs the NTDS service thinks it hosts. If a demotion crashed mid-write, the registry entry remains. Removing it tells the service to forget that NC. After reboot, the demotion check sees zero writable NCs.

Warning: Don't delete entries that match known partitions. You'll break AD. Only delete entries that are clearly orphaned — no match in ntdsutil or ADSI Edit.

Quick-Reference Summary Table

If you've tried all three and still hit the error, check for a forest trust that created a partition — but that's rare. The three fixes above cover 99% of cases. Don't force demotion with /forceremoval unless you're absolutely sure the DC is dead and you want to clean metadata manually later. It's a last resort.